diff options
-rw-r--r-- | ext/standard/tests/serialize/unserialize_neg_iv_edge_cases.phpt | 12 | ||||
-rw-r--r-- | ext/standard/var_unserializer.re | 4 |
2 files changed, 14 insertions, 2 deletions
diff --git a/ext/standard/tests/serialize/unserialize_neg_iv_edge_cases.phpt b/ext/standard/tests/serialize/unserialize_neg_iv_edge_cases.phpt new file mode 100644 index 0000000000..a3732bde1b --- /dev/null +++ b/ext/standard/tests/serialize/unserialize_neg_iv_edge_cases.phpt @@ -0,0 +1,12 @@ +--TEST-- +Negative parse_iv2 edge cases +--FILE-- +<?php + +var_dump(unserialize('i:-9223372036854775808;')); +var_dump(unserialize('i:-0;')); + +?> +--EXPECT-- +int(-9223372036854775808) +int(0) diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re index c99e673c8d..1eff008da8 100644 --- a/ext/standard/var_unserializer.re +++ b/ext/standard/var_unserializer.re @@ -357,12 +357,12 @@ static inline zend_long parse_iv2(const unsigned char *p, const unsigned char ** || (SIZEOF_ZEND_LONG == 4 && UNEXPECTED(p - start == MAX_LENGTH_OF_LONG - 1) && UNEXPECTED(*start > '2')) - || UNEXPECTED(result - neg > ZEND_LONG_MAX)) { + || UNEXPECTED(result > ZEND_LONG_MAX + neg)) { php_error_docref(NULL, E_WARNING, "Numerical result out of range"); return (!neg) ? ZEND_LONG_MAX : ZEND_LONG_MIN; } - return (!neg) ? (zend_long)result : -(zend_long)result; + return (zend_long) ((!neg) ? result : -result); } static inline zend_long parse_iv(const unsigned char *p) |