diff options
| author | Dmitry Stogov <dmitry@php.net> | 2009-03-24 16:02:50 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2009-03-24 16:02:50 +0000 |
| commit | 4658d9408b9614d1e298f3c02bc17ac62f638249 (patch) | |
| tree | 438e5b3b6c3d5d005017f33c68ffd0cee06a4021 | |
| parent | a3e90c2a63f9c17d49b6c111f40dc92046ff8c94 (diff) | |
| download | php-git-4658d9408b9614d1e298f3c02bc17ac62f638249.tar.gz | |
Fixed "-0" parsing and optimized overflow check (Matt)
| -rw-r--r-- | Zend/zend_hash.h | 54 |
1 files changed, 18 insertions, 36 deletions
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h index 793f85e865..618da2bfa4 100644 --- a/Zend/zend_hash.h +++ b/Zend/zend_hash.h @@ -314,47 +314,29 @@ END_EXTERN_C() const char *end = key + length - 1; \ long idx; \ \ - if (*end != '\0') { /* not a null terminated string */ \ + if ((*end != '\0') /* not a null terminated string */ \ + || (*tmp == '0' && length > 2) /* numbers with leading zeros */ \ + || (end - tmp > MAX_LENGTH_OF_LONG - 1) /* number too long */ \ + || (SIZEOF_LONG == 4 && \ + end - tmp == MAX_LENGTH_OF_LONG - 1 && \ + *tmp > '2')) { /* overflow */ \ break; \ - } else if (*tmp == '0') { \ - if (end - tmp != 1) { \ - /* don't accept numbers with leading zeros */ \ - break; \ - } \ - idx = 0; \ - } else if (end - tmp > MAX_LENGTH_OF_LONG - 1) { \ - /* don't accept too long strings */ \ - break; \ - } else { \ - if (end - tmp == MAX_LENGTH_OF_LONG - 1) { \ - end--; /* check overflow in last digit later */ \ - } \ - idx = (*tmp++ - '0'); \ - while (tmp != end && *tmp >= '0' && *tmp <= '9') { \ - idx = (idx * 10) + (*tmp++ - '0'); \ - } \ - if (tmp != end) { \ - break; \ - } \ - if (end != key + length - 1) { \ - /* last digit can cause overflow */ \ - if (*tmp < '0' || *tmp > '9' || idx > LONG_MAX / 10) { \ - break; \ - } \ - idx = (idx * 10) + (*tmp - '0'); \ - if (*key == '-') { \ - idx = -idx; \ - if (idx > 0) { /* overflow */ \ - break; \ - } \ - } else if (idx < 0) { /* overflow */ \ + } \ + idx = (*tmp - '0'); \ + while (++tmp != end && *tmp >= '0' && *tmp <= '9') { \ + idx = (idx * 10) + (*tmp - '0'); \ + } \ + if (tmp == end) { \ + if (*key == '-') { \ + idx = -idx; \ + if (idx > 0) { /* overflow */ \ break; \ } \ - } else if (*key == '-') { \ - idx = -idx; \ + } else if (idx < 0) { /* overflow */ \ + break; \ } \ + return func; \ } \ - return func; \ } \ } while (0) |