diff options
| author | Anatol Belski <ab@php.net> | 2016-10-12 16:11:32 +0200 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-10-14 01:43:23 +0200 |
| commit | 41ed9d1f9f1f0fd097e8157e42a4689d117e083d (patch) | |
| tree | 53d4f7d7bebba1de72388e0bb567e55d923fee5d | |
| parent | 7897e8cd6c1d6b201eb384fac38ed41a21420ae3 (diff) | |
| download | php-git-41ed9d1f9f1f0fd097e8157e42a4689d117e083d.tar.gz | |
Revert "Fix for #73240 - Write out of bounds at number_format"
This reverts commit 01280f8deb837a61237a619cffa886d7f8c31963.
The fix is already merged by Stas.
(cherry picked from commit 80eb013a926fad18cb0da05c508f564da3c1d88c)
| -rw-r--r-- | ext/standard/math.c | 13 |
1 files changed, 10 insertions, 3 deletions
diff --git a/ext/standard/math.c b/ext/standard/math.c index 753656c56f..83145a4dc9 100644 --- a/ext/standard/math.c +++ b/ext/standard/math.c @@ -1139,14 +1139,18 @@ PHPAPI zend_string *_php_math_number_format_ex(double d, int dec, char *dec_poin /* calculate the length of the return buffer */ if (dp) { - integral = (dp - ZSTR_VAL(tmpbuf)); + integral = (int)(dp - ZSTR_VAL(tmpbuf)); } else { /* no decimal point was found */ - integral = ZSTR_LEN(tmpbuf); + integral = (int)ZSTR_LEN(tmpbuf); } /* allow for thousand separators */ if (thousand_sep) { + if (integral + thousand_sep_len * ((integral-1) / 3) < integral) { + /* overflow */ + php_error_docref(NULL, E_ERROR, "String overflow"); + } integral += thousand_sep_len * ((integral-1) / 3); } @@ -1156,6 +1160,10 @@ PHPAPI zend_string *_php_math_number_format_ex(double d, int dec, char *dec_poin reslen += dec; if (dec_point) { + if (reslen + dec_point_len < dec_point_len) { + /* overflow */ + php_error_docref(NULL, E_ERROR, "String overflow"); + } reslen += dec_point_len; } } @@ -1258,7 +1266,6 @@ PHP_FUNCTION(number_format) break; default: WRONG_PARAM_COUNT; - break; } } /* }}} */ |