Skip to content

SNMP accepts malformed remote ports #25137

Open

Description

@somethingwithproof

Description

The following code:

<?php

new SNMP(SNMP::VERSION_1, '127.0.0.1:not-a-port', 'public');
new SNMP(SNMP::VERSION_1, '127.0.0.1:123junk', 'public');

does not throw an exception. The first port is interpreted as 0, and the
second is interpreted as 123.

I expected both malformed ports to result in a ValueError. The parser should
require at least one decimal digit, reject trailing characters, and enforce the
existing 0..65535 range.

PHP Version

PHP 8.4.28-dev (cli) (built: Nov  1 2026 11:27:04) (ZTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.4.28-dev, Copyright (c) Zend Technologies

The same permissive atoi() parsing is present on the current master branch.

Operating System

macOS 27.2 arm64

Activity

  1. somethingwithproof commented on Nov 1, 2026

    @somethingwithproof
    ContributorAuthor

    Fix proposed in #25138.

  2. added a commit that references this issue on Nov 15, 2026
    57df8b9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions