Fixed bug #45877 (Array key '2147483647' left as string)

4 files changed, 55 insertions, 34 deletions

diff --git a/Zend/tests/bug45877.phpt b/Zend/tests/bug45877.phpt
new file mode 100644
index 0000000000..b651c6639e
--- /dev/null
+++ b/Zend/tests/bug45877.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #45877 (Array key '2147483647' left as string)
+--FILE--
+<?php
+$keys = array(PHP_INT_MAX,
+	(string) PHP_INT_MAX,
+	(string) (-PHP_INT_MAX - 1),
+	-PHP_INT_MAX - 1,
+	(string) (PHP_INT_MAX + 1));
+
+var_dump(array_fill_keys($keys, 1));
+?>
+--EXPECTF--
+array(3) {
+  [%d7]=>
+  int(1)
+  [-%d8]=>
+  int(1)
+  [u"%d8"]=>
+  int(1)
+}
diff --git a/Zend/zend.h b/Zend/zend.h
index 1ba3f5e0a8..63e862b0dd 100644
--- a/Zend/zend.h
+++ b/Zend/zend.h
@@ -271,6 +271,18 @@ typedef union _zstr {
 #define LONG_MIN (- LONG_MAX - 1)
 #endif
 
+#if SIZEOF_LONG == 4
+#define MAX_LENGTH_OF_LONG 11
+static const char long_min_digits[] = "2147483648";
+#elif SIZEOF_LONG == 8
+#define MAX_LENGTH_OF_LONG 20
+static const char long_min_digits[] = "9223372036854775808";
+#else
+#error "Unknown SIZEOF_LONG"
+#endif
+
+#define MAX_LENGTH_OF_DOUBLE 32
+
 #ifdef __GNUC__
 #	define ZSTR(x)    ((zstr)((void*)(x)))
 #	define NULL_ZSTR  ZSTR((void*)NULL)
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
index 614608c1a2..d72b482af3 100644
--- a/Zend/zend_hash.h
+++ b/Zend/zend_hash.h
@@ -406,9 +406,10 @@ ZEND_API int zend_u_symtable_update_current_key(HashTable *ht, zend_uchar type,
 	}																					\
 	if ((*tmp>='0' && *tmp<='9')) do { /* possibly a numeric index */					\
 		const char *end=key+length-1;													\
-		long idx;																		\
+		long idx = end - tmp; /* temp var for remaining length (number of digits) */	\
 																						\
-		if (*tmp++=='0' && length>2) { /* don't accept numbers with leading zeros */	\
+		if (idx > MAX_LENGTH_OF_LONG - 1 || (*tmp++ == '0' && length > 2)) {			\
+			/* don't accept numbers too long or with leading zeros */					\
 			break;																		\
 		}																				\
 		while (tmp<end) {																\
@@ -418,17 +419,16 @@ ZEND_API int zend_u_symtable_update_current_key(HashTable *ht, zend_uchar type,
 			tmp++;																		\
 		}																				\
 		if (tmp==end && *tmp=='\0') { /* a numeric index */								\
-			if (*key=='-') {															\
-				idx = strtol(key, NULL, 10);											\
-				if (idx!=LONG_MIN) {													\
-					return func;														\
-				}																		\
-			} else {																	\
-				idx = strtol(key, NULL, 10);											\
-				if (idx!=LONG_MAX) {													\
-					return func;														\
+			if (idx == MAX_LENGTH_OF_LONG - 1) {										\
+				int cmp = strcmp(end - (MAX_LENGTH_OF_LONG - 1), long_min_digits);		\
+																						\
+				if (!(cmp < 0 || (cmp == 0 && *key == '-'))) {							\
+					break;																\
 				}																		\
 			}																			\
+																						\
+			idx = strtol(key, NULL, 10);												\
+			return func;																\
 		}																				\
 	} while (0);																		\
 }
@@ -441,9 +441,10 @@ ZEND_API int zend_u_symtable_update_current_key(HashTable *ht, zend_uchar type,
 	}																					\
 	if ((*tmp>=0x30 /*'0'*/ && *tmp<=0x39 /*'9'*/)) do { /* possibly a numeric index */	\
 		UChar *end=key+length-1;														\
-		long idx;																		\
+		long idx = end - tmp; /* temp var for remaining length (number of digits) */	\
 																						\
-		if (*tmp++==0x30 && length>2) { /* don't accept numbers with leading zeros */	\
+		if (idx > MAX_LENGTH_OF_LONG - 1 || (*tmp++ == 0x30 && length > 2)) {			\
+			/* don't accept numbers too long or with leading zeros */								\
 			break;																		\
 		}																				\
 		while (tmp<end) {																\
@@ -453,17 +454,16 @@ ZEND_API int zend_u_symtable_update_current_key(HashTable *ht, zend_uchar type,
 			tmp++;																		\
 		}																				\
 		if (tmp==end && *tmp==0) { /* a numeric index */								\
-			if (*key==0x2D /*'-'*/) {													\
-				idx = zend_u_strtol(key, NULL, 10);										\
-				if (idx!=LONG_MIN) {													\
-					return func;														\
-				}																		\
-			} else {																	\
-				idx = zend_u_strtol(key, NULL, 10);										\
-				if (idx!=LONG_MAX) {													\
-					return func;														\
+			if (idx == MAX_LENGTH_OF_LONG - 1) {										\
+				int cmp = zend_cmp_unicode_and_literal(end - (MAX_LENGTH_OF_LONG - 1), idx, long_min_digits, idx);	\
+																						\
+				if (!(cmp < 0 || (cmp == 0 && *key == 0x2D /*'-'*/))) {					\
+					break;																\
 				}																		\
 			}																			\
+																						\
+			idx = zend_u_strtol(key, NULL, 10);											\
+			return func;																\
 		}																				\
 	} while (0);																		\
 }
diff --git a/Zend/zend_operators.h b/Zend/zend_operators.h
index 5411f46ec7..0457e2ac37 100644
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@ -36,18 +36,6 @@
 #include "ext/bcmath/libbcmath/src/bcmath.h"
 #endif
 
-#if SIZEOF_LONG == 4
-#define MAX_LENGTH_OF_LONG 11
-static const char long_min_digits[] = "2147483648";
-#elif SIZEOF_LONG == 8
-#define MAX_LENGTH_OF_LONG 20
-static const char long_min_digits[] = "9223372036854775808";
-#else
-#error "Unknown SIZEOF_LONG"
-#endif
-
-#define MAX_LENGTH_OF_DOUBLE 32
-
 BEGIN_EXTERN_C()
 ZEND_API int add_function(zval *result, zval *op1, zval *op2 TSRMLS_DC);
 ZEND_API int sub_function(zval *result, zval *op1, zval *op2 TSRMLS_DC);