diff options
author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-02-02 13:38:34 +0100 |
---|---|---|
committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-02-03 12:28:32 +0100 |
commit | c2935499b14ee605452016ea00f3c0a94c0a1943 (patch) | |
tree | 7d5a86d2ee0e609ee8a5d91bcd2783aa453f23f7 | |
parent | ef1e4891b47949c8dc0f9482eef9454a0ecdfa1d (diff) | |
download | php-git-c2935499b14ee605452016ea00f3c0a94c0a1943.tar.gz |
Fix #79212: NumberFormatter::format() may detect wrong type
We have to convert to number *before* detecting the type, to cater to
internal objects implementing `cast_object`.
We also get rid of the fallback behavior of using `FORMAT_TYPE_INT32`,
because that can no longer happen; after `convert_scalar_to_number_ex`
the type is either `IS_LONG` or `IS_DOUBLE`. We cater explicitly to
the `IS_ARRAY` case what also avoids triggering a type confusion when
`::TYPE_INT64` is passed as `$type`.
-rw-r--r-- | NEWS | 3 | ||||
-rw-r--r-- | ext/intl/formatter/formatter_format.c | 30 | ||||
-rw-r--r-- | ext/intl/tests/bug79212.phpt | 18 |
3 files changed, 36 insertions, 15 deletions
@@ -14,6 +14,9 @@ PHP NEWS . Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()). (cmb) + -Intl: + . Fixed bug #79212 (NumberFormatter::format() may detect wrong type). (cmb) + - MBString: . Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). (cmb) diff --git a/ext/intl/formatter/formatter_format.c b/ext/intl/formatter/formatter_format.c index f3253dcdb2..9736674d77 100644 --- a/ext/intl/formatter/formatter_format.c +++ b/ext/intl/formatter/formatter_format.c @@ -53,23 +53,23 @@ PHP_FUNCTION( numfmt_format ) /* Fetch the object. */ FORMATTER_METHOD_FETCH_OBJECT; - if(type == FORMAT_TYPE_DEFAULT) { - if(Z_TYPE_P(number) == IS_STRING) { - convert_scalar_to_number_ex(number); - } - - if(Z_TYPE_P(number) == IS_LONG) { - /* take INT32 on 32-bit, int64 on 64-bit */ - type = (sizeof(zend_long) == 8)?FORMAT_TYPE_INT64:FORMAT_TYPE_INT32; - } else if(Z_TYPE_P(number) == IS_DOUBLE) { - type = FORMAT_TYPE_DOUBLE; - } else { - type = FORMAT_TYPE_INT32; - } + if(Z_TYPE_P(number) != IS_ARRAY) { + convert_scalar_to_number_ex(number); + } else { + convert_to_long(number); } - if(Z_TYPE_P(number) != IS_DOUBLE && Z_TYPE_P(number) != IS_LONG) { - convert_scalar_to_number(number ); + if(type == FORMAT_TYPE_DEFAULT) { + switch(Z_TYPE_P(number)) { + case IS_LONG: + /* take INT32 on 32-bit, int64 on 64-bit */ + type = (sizeof(zend_long) == 8)?FORMAT_TYPE_INT64:FORMAT_TYPE_INT32; + break; + case IS_DOUBLE: + type = FORMAT_TYPE_DOUBLE; + break; + EMPTY_SWITCH_DEFAULT_CASE(); + } } switch(type) { diff --git a/ext/intl/tests/bug79212.phpt b/ext/intl/tests/bug79212.phpt new file mode 100644 index 0000000000..0f7897acc4 --- /dev/null +++ b/ext/intl/tests/bug79212.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #79212 (NumberFormatter::format() may detect wrong type) +--SKIPIF-- +<?php +if (!extension_loaded('intl')) die('skip intl extension not available'); +if (!extension_loaded('gmp')) die('skip gmp extension not available'); +?> +--FILE-- +<?php +$fmt = new NumberFormatter('en_US', NumberFormatter::PATTERN_DECIMAL); +var_dump($fmt->format(gmp_init('823749273428379492374'))); + +$fmt = new NumberFormatter('en_US', NumberFormatter::PATTERN_DECIMAL); +var_dump($fmt->format([1], NumberFormatter::TYPE_INT64)); +?> +--EXPECT-- +string(21) "823749273428379400000" +string(1) "1" |