From 45a05f38410d4a67c8c83c09906e2cfb42fc6e4c Mon Sep 17 00:00:00 2001
From: Anatol Belski <ab@php.net>
Date: Thu, 9 Aug 2018 22:07:24 +0200
Subject: [PATCH] Fixed bug #74484 MessageFormatter::formatMessage memory
 corruption

with 11+ named placeholder
---
 ext/intl/msgformat/msgformat_helpers.cpp      | 19 +++++++++++
 ext/intl/tests/bug74484_MessageFormatter.phpt | 33 +++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 ext/intl/tests/bug74484_MessageFormatter.phpt

diff --git a/ext/intl/msgformat/msgformat_helpers.cpp b/ext/intl/msgformat/msgformat_helpers.cpp
index ce7899edd99..29956c7ee08 100644
--- a/ext/intl/msgformat/msgformat_helpers.cpp
+++ b/ext/intl/msgformat/msgformat_helpers.cpp
@@ -27,6 +27,7 @@
 #include <unicode/timezone.h>
 #include <unicode/datefmt.h>
 #include <unicode/calendar.h>
+#include <unicode/strenum.h>
 
 #include <vector>
 
@@ -333,6 +334,24 @@ static void umsg_set_timezone(MessageFormatter_object *mfo,
 		return; /* already done */
 	}
 
+	/* There is a bug in ICU which prevents MessageFormatter::getFormats()
+	   to handle more than 10 formats correctly. The enumerator could be
+	   used to walk through the present formatters using getFormat(), which
+	   however seems to provide just a readonly access. This workaround
+	   prevents crash when there are > 10 formats but doesn't set any error.
+	   As a result, only DateFormatters with > 10 subformats are affected.
+	   This workaround should be ifdef'd out, when the bug has been fixed
+	   in ICU. */
+	icu::StringEnumeration* fnames = mf->getFormatNames(err.code);
+	if (!fnames || U_FAILURE(err.code)) {
+		return;
+	}
+	count = fnames->count(err.code);
+	delete fnames;
+	if (count > 10) {
+		return;
+	}
+
 	formats = mf->getFormats(count);
 
 	if (formats == NULL) {
diff --git a/ext/intl/tests/bug74484_MessageFormatter.phpt b/ext/intl/tests/bug74484_MessageFormatter.phpt
new file mode 100644
index 00000000000..b48de335259
--- /dev/null
+++ b/ext/intl/tests/bug74484_MessageFormatter.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #74484 MessageFormatter::formatMessage memory corruption with 11+ named placeholder
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+?>
+--FILE--
+<?php
+$text = "{a} {b} {c} {d} {e} {f} {g} {h} {i} {j} {k} {l}";
+
+$vars = array(
+  'a' => 1,
+  'b' => 2,
+  'c' => 3,
+  'd' => 4,
+  'e' => 5,
+  'f' => 6,
+  'g' => 7,
+  'h' => 8,
+  'i' => 9,
+  'j' => 10,
+  'k' => 11,
+  'l' => 12
+);
+
+var_dump(MessageFormatter::formatMessage('en_US', $text, $vars));
+
+?>
+==DONE==
+--EXPECT--
+string(26) "1 2 3 4 5 6 7 8 9 10 11 12"
+==DONE==