Check that readRaw does not accept negative length value.

Fixes #24159

PiperOrigin-RevId: 855837030

Author: protobuf-github-bot

php/src/Google/Protobuf/Internal/CodedInputStream.php

@@ -271,7 +271,8 @@ public function readTag()
     public function readRaw($size, &$buffer)
     {
         $current_buffer_size = 0;
-        if ($this->bufferSize() < $size) {
+        // size (varint) read from the wire could be negative.
+        if ($size < 0 || $this->bufferSize() < $size) {
             return false;
         }
 

php/tests/EncodeDecodeTest.php

@@ -603,6 +603,13 @@ public function testDecodeNegativeInt32()
         $this->assertEquals(-1, $m->getOptionalInt32());
     }
 
+    public function testInvalidVarintLength() {
+        $this->expectException(Exception::class);
+
+        $m = new TestMessage();
+        $m->mergeFromString(hex2bin("0afaffffff0f"));
+    }
+
     private function makeRecursiveMessage($depth) {
         $m = new TestMessage();
         $m->setOptionalInt32(1);