diff options
author | Anatol Belski <ab@php.net> | 2018-08-09 22:07:24 +0200 |
---|---|---|
committer | Anatol Belski <ab@php.net> | 2018-08-09 22:07:24 +0200 |
commit | 45a05f38410d4a67c8c83c09906e2cfb42fc6e4c (patch) | |
tree | 0ca8d9a664421d5a35c840ea81cb03f277c13aba | |
parent | 935625f1b88c69ceecb2c391fd18a14b1be4b4f7 (diff) | |
download | php-git-45a05f38410d4a67c8c83c09906e2cfb42fc6e4c.tar.gz |
Fixed bug #74484 MessageFormatter::formatMessage memory corruption
with 11+ named placeholder
-rw-r--r-- | ext/intl/msgformat/msgformat_helpers.cpp | 19 | ||||
-rw-r--r-- | ext/intl/tests/bug74484_MessageFormatter.phpt | 33 |
2 files changed, 52 insertions, 0 deletions
diff --git a/ext/intl/msgformat/msgformat_helpers.cpp b/ext/intl/msgformat/msgformat_helpers.cpp index ce7899edd9..29956c7ee0 100644 --- a/ext/intl/msgformat/msgformat_helpers.cpp +++ b/ext/intl/msgformat/msgformat_helpers.cpp @@ -27,6 +27,7 @@ #include <unicode/timezone.h> #include <unicode/datefmt.h> #include <unicode/calendar.h> +#include <unicode/strenum.h> #include <vector> @@ -333,6 +334,24 @@ static void umsg_set_timezone(MessageFormatter_object *mfo, return; /* already done */ } + /* There is a bug in ICU which prevents MessageFormatter::getFormats() + to handle more than 10 formats correctly. The enumerator could be + used to walk through the present formatters using getFormat(), which + however seems to provide just a readonly access. This workaround + prevents crash when there are > 10 formats but doesn't set any error. + As a result, only DateFormatters with > 10 subformats are affected. + This workaround should be ifdef'd out, when the bug has been fixed + in ICU. */ + icu::StringEnumeration* fnames = mf->getFormatNames(err.code); + if (!fnames || U_FAILURE(err.code)) { + return; + } + count = fnames->count(err.code); + delete fnames; + if (count > 10) { + return; + } + formats = mf->getFormats(count); if (formats == NULL) { diff --git a/ext/intl/tests/bug74484_MessageFormatter.phpt b/ext/intl/tests/bug74484_MessageFormatter.phpt new file mode 100644 index 0000000000..b48de33525 --- /dev/null +++ b/ext/intl/tests/bug74484_MessageFormatter.phpt @@ -0,0 +1,33 @@ +--TEST-- +Bug #74484 MessageFormatter::formatMessage memory corruption with 11+ named placeholder +--SKIPIF-- +<?php +if (!extension_loaded('intl')) + die('skip intl extension not enabled'); +?> +--FILE-- +<?php +$text = "{a} {b} {c} {d} {e} {f} {g} {h} {i} {j} {k} {l}"; + +$vars = array( + 'a' => 1, + 'b' => 2, + 'c' => 3, + 'd' => 4, + 'e' => 5, + 'f' => 6, + 'g' => 7, + 'h' => 8, + 'i' => 9, + 'j' => 10, + 'k' => 11, + 'l' => 12 +); + +var_dump(MessageFormatter::formatMessage('en_US', $text, $vars)); + +?> +==DONE== +--EXPECT-- +string(26) "1 2 3 4 5 6 7 8 9 10 11 12" +==DONE== |