Fix fseek() accepting $whence values that do not fit in an int

$whence is parsed as a zend_long but cast to a C int when handed to
php_stream_seek(). Values whose low 32 bits alias onto a valid seek
constant were accepted and acted upon: on a 64-bit build, SEEK_CUR +
2**32 seeks relative to the current position, SEEK_END + 2**32 relative
to the end, and PHP_INT_MIN relative to the start, each returning 0 for
success.

Reject values outside the int range before the cast and return -1,
which is already what fseek() returns for an invalid $whence that does
fit in an int. Platform constants such as SEEK_DATA and SEEK_HOLE fit in
an int and keep working.

Author: lacatoire

NEWS

@@ -30,6 +30,8 @@ PHP                                                                        NEWS
   . Fixed an out-of-bounds read when following a redirect response with an
     empty Location header. (iliaal)
   . Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)
+  . Fixed fseek() accepting $whence values that do not fit in an int, which
+    were silently truncated onto a valid seek constant. (lacatoire)
 
 
 27 Aug 2026, PHP 8.6.0beta2

ext/standard/file.c

@@ -1104,6 +1104,10 @@ PHPAPI PHP_FUNCTION(fseek)
 		Z_PARAM_LONG(whence)
 	ZEND_PARSE_PARAMETERS_END();
 
+	if (whence < INT_MIN || whence > INT_MAX) {
+		RETURN_LONG(-1);
+	}
+
 	php_stream_error_operation_begin();
 	RETVAL_LONG(php_stream_seek(stream, offset, (int) whence));
 	php_stream_error_operation_end_for_stream(stream);

ext/standard/tests/file/fseek_whence_overflow.phpt

@@ -0,0 +1,46 @@
+--TEST--
+fseek(): $whence values that overflow int must return -1, not alias onto a valid constant
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE < 8) die("skip 64-bit only");
+?>
+--FILE--
+<?php
+$tmp = tempnam(sys_get_temp_dir(), 'fseek');
+file_put_contents($tmp, "0123456789");
+$bias = 2 ** 32;
+
+$h = fopen($tmp, 'r');
+
+// SEEK_CUR + 2**32 must not alias onto SEEK_CUR (1)
+fseek($h, 4);
+var_dump(fseek($h, 3, SEEK_CUR + $bias));  // -1
+var_dump(ftell($h));                        // 4 (unchanged)
+
+// SEEK_END + 2**32 must not alias onto SEEK_END (2)
+fseek($h, 4);
+var_dump(fseek($h, 3, SEEK_END + $bias));  // -1
+var_dump(ftell($h));                        // 4 (unchanged)
+
+// PHP_INT_MIN must not alias onto SEEK_SET (0)
+fseek($h, 4);
+var_dump(fseek($h, 3, PHP_INT_MIN));       // -1
+var_dump(ftell($h));                        // 4 (unchanged)
+
+// Sanity: normal SEEK_CUR still works
+fseek($h, 4);
+var_dump(fseek($h, 3, SEEK_CUR));          // 0
+var_dump(ftell($h));                        // 7
+
+fclose($h);
+unlink($tmp);
+?>
+--EXPECT--
+int(-1)
+int(4)
+int(-1)
+int(4)
+int(-1)
+int(4)
+int(0)
+int(7)