diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2016-08-30 15:02:14 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2016-08-30 15:12:49 +0200 |
| commit | ecdef60d000210f4d22e95de4209db73a0c8344f (patch) | |
| tree | 128b7aad1e4cdffd6bd67f3e12cf7441d2fe4eb0 | |
| parent | 3d66d56c1d0d1185851eeefacfb4ffb581ce8a24 (diff) | |
| parent | 972302d2f0bb12689db280df8a3daadb0d5003b3 (diff) | |
| download | php-git-ecdef60d000210f4d22e95de4209db73a0c8344f.tar.gz | |
Merge branch 'PHP-7.0' into PHP-7.1
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/mbstring/mbstring.c | 7 | ||||
| -rw-r--r-- | ext/mbstring/tests/bug66797.phpt | 23 |
3 files changed, 33 insertions, 0 deletions
@@ -36,6 +36,9 @@ PHP NEWS (Stacking exceptions thrown by JsonSerializable) and #70275 (On recursion error, json_encode can eat up all system memory). (Jakub Zelenka) +- mbstring: + . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb) + - Opcache: . Fixed bug #72949 (Typo in opcache error message). (cmb) diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c index a44a9dade1..1ddc5ffd02 100644 --- a/ext/mbstring/mbstring.c +++ b/ext/mbstring/mbstring.c @@ -2934,6 +2934,13 @@ PHP_FUNCTION(mb_substr) RETURN_FALSE; } + if (from > INT_MAX) { + from = INT_MAX; + } + if (len > INT_MAX) { + len = INT_MAX; + } + ret = mbfl_substr(&string, &result, from, len); if (NULL == ret) { RETURN_FALSE; diff --git a/ext/mbstring/tests/bug66797.phpt b/ext/mbstring/tests/bug66797.phpt new file mode 100644 index 0000000000..df9e789be6 --- /dev/null +++ b/ext/mbstring/tests/bug66797.phpt @@ -0,0 +1,23 @@ +--TEST-- +Bug #66797 (mb_substr only takes 32-bit signed integer) +--SKIPIF-- +<?php +if (!extension_loaded('mbstring')) die('skip mbstring extension not available'); +if (PHP_INT_SIZE != 8) die('skip this test is for 64bit platforms only'); +?> +--FILE-- +<?php +var_dump( + mb_substr('bar', 0, 0x7fffffff), + mb_substr('bar', 0, 0x80000000), + mb_substr('bar', 0xffffffff, 1), + mb_substr('bar', 0x100000000, 1) +); +?> +==DONE== +--EXPECTF-- +string(3) "bar" +string(3) "bar" +string(0) "" +string(0) "" +==DONE== |