cvs: ZendEngine2(PHP_5_2) / zend.h zend_hash.h zend_operators.h /tests bug45877.phpt php-src NEWS
[email protected] ("Matt Wilmas") Thu, 14 May 2009 01:28:15 -0000
| Newsgroups | php.zend-engine.cvs |
|---|---|
| Message-ID | <cvsmattwil1242264495@cvsserver> |
mattwil Thu May 14 01:28:15 2009 UTC
Added files: (Branch: PHP_5_2)
/ZendEngine2/tests bug45877.phpt
Modified files:
/php-src NEWS
/ZendEngine2 zend.h zend_hash.h zend_operators.h
Log:
MFH: Fixed bug #45877 (Array key '2147483647' left as string)
http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.1504&r2=1.2027.2.547.2.1505&diff_format=u
Index: php-src/NEWS
diff -u php-src/NEWS:1.2027.2.547.2.1504 php-src/NEWS:1.2027.2.547.2.1505
--- php-src/NEWS:1.2027.2.547.2.1504 Wed May 13 14:25:58 2009
+++ php-src/NEWS Thu May 14 01:28:14 2009
@@ -83,6 +83,7 @@
different bit numbers). (Matt)
- Fixed bug #45997 (safe_mode bypass with exec/system/passthru (windows only)).
(Pierre)
+- Fixed bug #45877 (Array key '2147483647' left as string). (Matt)
- Fixed bug #45822 (Near infinite-loops while parsing huge relative offsets).
(Derick, Mike Sullivan)
- Fixed bug #45799 (imagepng() crashes on empty image). (Martin McNickle,
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend.h?r1=1.293.2.11.2.12&r2=1.293.2.11.2.13&diff_format=u
Index: ZendEngine2/zend.h
diff -u ZendEngine2/zend.h:1.293.2.11.2.12 ZendEngine2/zend.h:1.293.2.11.2.13
--- ZendEngine2/zend.h:1.293.2.11.2.12 Wed Dec 31 11:17:32 2008
+++ ZendEngine2/zend.h Thu May 14 01:28:15 2009
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend.h,v 1.293.2.11.2.12 2008/12/31 11:17:32 sebastian Exp $ */
+/* $Id: zend.h,v 1.293.2.11.2.13 2009/05/14 01:28:15 mattwil Exp $ */
#ifndef ZEND_H
#define ZEND_H
@@ -249,6 +249,18 @@
#define LONG_MIN (- LONG_MAX - 1)
#endif
+#if SIZEOF_LONG == 4
+#define MAX_LENGTH_OF_LONG 11
+static const char long_min_digits[] = "2147483648";
+#elif SIZEOF_LONG == 8
+#define MAX_LENGTH_OF_LONG 20
+static const char long_min_digits[] = "9223372036854775808";
+#else
+#error "Unknown SIZEOF_LONG"
+#endif
+
+#define MAX_LENGTH_OF_DOUBLE 32
+
#undef SUCCESS
#undef FAILURE
#define SUCCESS 0
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_hash.h?r1=1.78.2.2.2.4&r2=1.78.2.2.2.5&diff_format=u
Index: ZendEngine2/zend_hash.h
diff -u ZendEngine2/zend_hash.h:1.78.2.2.2.4 ZendEngine2/zend_hash.h:1.78.2.2.2.5
--- ZendEngine2/zend_hash.h:1.78.2.2.2.4 Wed Dec 31 11:17:33 2008
+++ ZendEngine2/zend_hash.h Thu May 14 01:28:15 2009
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_hash.h,v 1.78.2.2.2.4 2008/12/31 11:17:33 sebastian Exp $ */
+/* $Id: zend_hash.h,v 1.78.2.2.2.5 2009/05/14 01:28:15 mattwil Exp $ */
#ifndef ZEND_HASH_H
#define ZEND_HASH_H
@@ -298,40 +298,41 @@
zend_hash_init(ht, n, NULL, ZVAL_PTR_DTOR, persistent)
-#define HANDLE_NUMERIC(key, length, func) { \
- register char *tmp=key; \
- \
- if (*tmp=='-') { \
- tmp++; \
- } \
- if ((*tmp>='0' && *tmp<='9')) do { /* possibly a numeric index */ \
- char *end=key+length-1; \
- long idx; \
- \
- if (*tmp++=='0' && length>2) { /* don't accept numbers with leading zeros */ \
- break; \
- } \
- while (tmp<end) { \
- if (!(*tmp>='0' && *tmp<='9')) { \
- break; \
- } \
- tmp++; \
- } \
- if (tmp==end && *tmp=='\0') { /* a numeric index */ \
- if (*key=='-') { \
- idx = strtol(key, NULL, 10); \
- if (idx!=LONG_MIN) { \
- return func; \
- } \
- } else { \
- idx = strtol(key, NULL, 10); \
- if (idx!=LONG_MAX) { \
- return func; \
- } \
- } \
- } \
- } while (0); \
-}
+#define HANDLE_NUMERIC(key, length, func) do { \
+ register const char *tmp = key; \
+ \
+ if (*tmp == '-') { \
+ tmp++; \
+ } \
+ if (*tmp >= '0' && *tmp <= '9') { /* possibly a numeric index */ \
+ const char *end = key + length - 1; \
+ long idx; \
+ \
+ if ((*end != '\0') /* not a null terminated string */ \
+ || (*tmp == '0' && length > 2) /* numbers with leading zeros */ \
+ || (end - tmp > MAX_LENGTH_OF_LONG - 1) /* number too long */ \
+ || (SIZEOF_LONG == 4 && \
+ end - tmp == MAX_LENGTH_OF_LONG - 1 && \
+ *tmp > '2')) { /* overflow */ \
+ break; \
+ } \
+ idx = (*tmp - '0'); \
+ while (++tmp != end && *tmp >= '0' && *tmp <= '9') { \
+ idx = (idx * 10) + (*tmp - '0'); \
+ } \
+ if (tmp == end) { \
+ if (*key == '-') { \
+ idx = -idx; \
+ if (idx > 0) { /* overflow */ \
+ break; \
+ } \
+ } else if (idx < 0) { /* overflow */ \
+ break; \
+ } \
+ return func; \
+ } \
+ } \
+} while (0)
static inline int zend_symtable_update(HashTable *ht, char *arKey, uint nKeyLength, void *pData, uint nDataSize, void **pDest) \
@@ -343,7 +344,7 @@
static inline int zend_symtable_del(HashTable *ht, char *arKey, uint nKeyLength)
{
- HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_index_del(ht, idx))
+ HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_index_del(ht, idx));
return zend_hash_del(ht, arKey, nKeyLength);
}
http://cvs.php.net/viewvc.cgi/ZendEngine2/zend_operators.h?r1=1.94.2.4.2.15&r2=1.94.2.4.2.16&diff_format=u
Index: ZendEngine2/zend_operators.h
diff -u ZendEngine2/zend_operators.h:1.94.2.4.2.15 ZendEngine2/zend_operators.h:1.94.2.4.2.16
--- ZendEngine2/zend_operators.h:1.94.2.4.2.15 Sun Feb 15 14:31:17 2009
+++ ZendEngine2/zend_operators.h Thu May 14 01:28:15 2009
@@ -17,7 +17,7 @@
+----------------------------------------------------------------------+
*/
-/* $Id: zend_operators.h,v 1.94.2.4.2.15 2009/02/15 14:31:17 iliaa Exp $ */
+/* $Id: zend_operators.h,v 1.94.2.4.2.16 2009/05/14 01:28:15 mattwil Exp $ */
#ifndef ZEND_OPERATORS_H
#define ZEND_OPERATORS_H
@@ -36,18 +36,6 @@
#include "ext/bcmath/libbcmath/src/bcmath.h"
#endif
-#if SIZEOF_LONG == 4
-#define MAX_LENGTH_OF_LONG 11
-static const char long_min_digits[] = "2147483648";
-#elif SIZEOF_LONG == 8
-#define MAX_LENGTH_OF_LONG 20
-static const char long_min_digits[] = "9223372036854775808";
-#else
-#error "Unknown SIZEOF_LONG"
-#endif
-
-#define MAX_LENGTH_OF_DOUBLE 32
-
BEGIN_EXTERN_C()
ZEND_API int add_function(zval *result, zval *op1, zval *op2 TSRMLS_DC);
ZEND_API int sub_function(zval *result, zval *op1, zval *op2 TSRMLS_DC);
http://cvs.php.net/viewvc.cgi/ZendEngine2/tests/bug45877.phpt?view=markup&rev=1.1
Index: ZendEngine2/tests/bug45877.phpt
+++ ZendEngine2/tests/bug45877.phpt
--TEST--
Bug #45877 (Array key '2147483647' left as string)
--FILE--
<?php
$keys = array(PHP_INT_MAX,
(string) PHP_INT_MAX,
(string) (-PHP_INT_MAX - 1),
-PHP_INT_MAX - 1,
(string) (PHP_INT_MAX + 1));
var_dump(array_fill_keys($keys, 1));
?>
--EXPECTF--
array(3) {
[%d7]=>
int(1)
[-%d8]=>
int(1)
[u"%d8"]=>
int(1)
}