Check that _php_math_basetolong result fits long (by request from Troels Arvin)

1 files changed, 4 insertions, 0 deletions

diff --git a/ext/standard/math.c b/ext/standard/math.c
index bfdade04ca..89c529623c 100644
--- a/ext/standard/math.c
+++ b/ext/standard/math.c
@@ -752,6 +752,10 @@ _php_math_basetolong(zval *arg, int base) {
 		if (digit >= base) {
 			continue;
 		}
+		if(!mult || digit > LONG_MAX/mult || num > LONG_MAX-mult*digit) {
+			php_error(E_WARNING, "base_to_long: number '%s' is too big to fit in long", s);
+			return LONG_MAX;
+		}
 		num += mult * digit;
 	}