php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.1' into PHP-8.2

Browse Source 
* PHP-8.1:
  Prevent int overflow on $decimals in number_format
This commit is contained in:
Niels Dossche
2023-07-21 13:51:04 +02:00
parent 404f1d3700 429f20e981
commit 31bd62865f
2 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -13,6 +13,9 @@ PHP NEWS
. Fixed bug GH-11715 (opcache.interned_strings_buffer either has no effect or
opcache_get_status() / phpinfo() is wrong). (nielsdos)
- Standard:
. Prevent int overflow on $decimals in number_format. (Marc Bennewitz)
03 Aug 2023, PHP 8.2.9
- Build:

17
ext/standard/math.c
View File

@@ -283,15 +283,11 @@ PHP_FUNCTION(round)
ZEND_PARSE_PARAMETERS_END();
if (ZEND_NUM_ARGS() >= 2) {
#if SIZEOF_ZEND_LONG > SIZEOF_INT
if (precision >= 0) {
places = precision > INT_MAX ? INT_MAX : (int)precision;
places = ZEND_LONG_INT_OVFL(precision) ? INT_MAX : (int)precision;
} else {
places = precision <= INT_MIN ? INT_MIN+1 : (int)precision;
places = ZEND_LONG_INT_UDFL(precision) ? INT_MIN : (int)precision;
}
#else
places = precision;
#endif
}
switch (Z_TYPE_P(value)) {
@@ -1136,6 +1132,7 @@ PHP_FUNCTION(number_format)
{
double num;
zend_long dec = 0;
int dec_int;
char *thousand_sep = NULL, *dec_point = NULL;
size_t thousand_sep_len = 0, dec_point_len = 0;
@@ -1156,7 +1153,13 @@ PHP_FUNCTION(number_format)
thousand_sep_len = 1;
}
RETURN_STR(_php_math_number_format_ex(num, (int)dec, dec_point, dec_point_len, thousand_sep, thousand_sep_len));
if (dec >= 0) {
dec_int = ZEND_LONG_INT_OVFL(dec) ? INT_MAX : (int)dec;
} else {
dec_int = ZEND_LONG_INT_UDFL(dec) ? INT_MIN : (int)dec;
}
RETURN_STR(_php_math_number_format_ex(num, dec_int, dec_point, dec_point_len, thousand_sep, thousand_sep_len));
}
/* }}} */