From 90cdc4d00a4f5a279513eae13fb70170f22c810c Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Fri, 10 Apr 2026 05:58:23 +0100
Subject: [PATCH 1/2] Fix GH-21700: _php_stream_seek() assertion triggered on
 negative offset.

---
 main/streams/streams.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/main/streams/streams.c b/main/streams/streams.c
index 201e59446cf4..f2896357c0ed 100644
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1414,7 +1414,8 @@ PHPAPI int _php_stream_seek(php_stream *stream, zend_off_t offset, int whence)
 					offset = stream->position + offset;
 				}
  				whence = SEEK_SET;
-				break;
+				/* fall through to reject a possible negative offset */
+				ZEND_FALLTHROUGH;
 			case SEEK_SET:
 				if (offset < 0) {
 					return -1;

From b9088cafb84a422dfd4f217521d8128cd4ee2dba Mon Sep 17 00:00:00 2001
From: David Carlier <devnexen@gmail.com>
Date: Fri, 10 Apr 2026 06:17:22 +0100
Subject: [PATCH 2/2] add test

---
 ext/standard/tests/streams/gh21700.phpt | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 ext/standard/tests/streams/gh21700.phpt

diff --git a/ext/standard/tests/streams/gh21700.phpt b/ext/standard/tests/streams/gh21700.phpt
new file mode 100644
index 000000000000..a67032380962
--- /dev/null
+++ b/ext/standard/tests/streams/gh21700.phpt
@@ -0,0 +1,22 @@
+--TEST--
+GH-21700 (_php_stream_seek assertion on SEEK_CUR with resolved negative offset)
+--CREDITS--
+YuanchengJiang
+--FILE--
+<?php
+class wrapper {
+    public int $pos = 0;
+    public $context;
+    function stream_open($path, $mode, $options, &$opened_path): bool { return true; }
+    function stream_seek($offset, $whence): bool { $this->pos = $offset; return true; }
+    function stream_tell(): int { return $this->pos; }
+}
+stream_wrapper_register("gh21700", "wrapper");
+$fp = fopen("gh21700://", "rb");
+var_dump(fseek($fp, -1, SEEK_CUR));
+var_dump(fseek($fp, 0, SEEK_CUR));
+fclose($fp);
+?>
+--EXPECT--
+int(-1)
+int(0)