Fix SplFileObject::fseek() accepting $whence values that do not fit in an int

SplFileObject::fseek() casts $whence to a C int the same way fseek()
did, so a value whose low 32 bits alias onto a seek constant is accepted
and acted upon while the call reports success.

The line cache is now freed only when the seek succeeds, so a failed
seek leaves current() describing the unchanged position.

Author: lacatoire

NEWS

@@ -26,6 +26,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
     (Weilin Du)
 
+- SPL:
+  . Fixed SplFileObject::fseek() accepting $whence values that do not fit in an
+    int, which were silently truncated onto a valid seek constant. (lacatoire)
+
 - Standard:
   . Fixed a segfault when a stream filter callback unsets StreamBucket::$data
     before re-attaching the bucket. (iliaal)

ext/spl/spl_directory.c

@@ -2459,8 +2459,17 @@ PHP_METHOD(SplFileObject, fseek)
 
 	CHECK_SPL_FILE_OBJECT_IS_INITIALIZED(intern);
 
-	spl_filesystem_file_free_line(intern);
-	RETURN_LONG(php_stream_seek(intern->u.file.stream, pos, (int)whence));
+	if (ZEND_LONG_EXCEEDS_INT(whence)) {
+		RETURN_LONG(-1);
+	}
+
+	int ret = php_stream_seek(intern->u.file.stream, pos, (int)whence);
+
+	if (ret == 0) {
+		spl_filesystem_file_free_line(intern);
+	}
+
+	RETURN_LONG(ret);
 } /* }}} */
 
 /* {{{ Get a character from the file */

ext/spl/tests/SplFileObject/SplFileObject_fseek_whence_invalid_inrange.phpt

@@ -0,0 +1,48 @@
+--TEST--
+SplFileObject::fseek(): a failed seek must not discard the current line
+--FILE--
+<?php
+$tmp = __DIR__ . '/SplFileObject_fseek_whence_invalid_inrange.tmp';
+file_put_contents($tmp, "aaa\nbbb\nccc\n");
+
+foreach ([99, -2147483648, 2147483647] as $whence) {
+    echo 'whence=', $whence, PHP_EOL;
+
+    $file = new SplFileObject($tmp);
+    var_dump($file->current());
+    var_dump($file->fseek(3, $whence));
+    var_dump($file->ftell());
+    var_dump($file->current());
+    unset($file);
+
+    echo PHP_EOL;
+}
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/SplFileObject_fseek_whence_invalid_inrange.tmp');
+?>
+--EXPECT--
+whence=99
+string(4) "aaa
+"
+int(-1)
+int(4)
+string(4) "aaa
+"
+
+whence=-2147483648
+string(4) "aaa
+"
+int(-1)
+int(4)
+string(4) "aaa
+"
+
+whence=2147483647
+string(4) "aaa
+"
+int(-1)
+int(4)
+string(4) "aaa
+"

ext/spl/tests/SplFileObject/SplFileObject_fseek_whence_overflow.phpt

@@ -0,0 +1,49 @@
+--TEST--
+SplFileObject::fseek(): $whence values that overflow int must return -1, not alias onto a valid constant
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE < 8) die("skip 64-bit only");
+?>
+--FILE--
+<?php
+$tmp = __DIR__ . '/SplFileObject_fseek_whence_overflow.tmp';
+file_put_contents($tmp, "0123456789");
+$bias = 2 ** 32;
+
+$file = new SplFileObject($tmp);
+
+// SEEK_CUR + 2**32 must not alias onto SEEK_CUR (1)
+$file->fseek(4);
+var_dump($file->fseek(3, SEEK_CUR + $bias));  // -1
+var_dump($file->ftell());                     // 4 (unchanged)
+
+// SEEK_END + 2**32 must not alias onto SEEK_END (2)
+$file->fseek(4);
+var_dump($file->fseek(3, SEEK_END + $bias));  // -1
+var_dump($file->ftell());                     // 4 (unchanged)
+
+// PHP_INT_MIN must not alias onto SEEK_SET (0)
+$file->fseek(4);
+var_dump($file->fseek(3, PHP_INT_MIN));       // -1
+var_dump($file->ftell());                     // 4 (unchanged)
+
+// Sanity: normal SEEK_CUR still works
+$file->fseek(4);
+var_dump($file->fseek(3, SEEK_CUR));          // 0
+var_dump($file->ftell());                     // 7
+
+unset($file);
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/SplFileObject_fseek_whence_overflow.tmp');
+?>
+--EXPECT--
+int(-1)
+int(4)
+int(-1)
+int(4)
+int(-1)
+int(4)
+int(0)
+int(7)