diff options
| author | Stanislav Malyshev <stas@php.net> | 2013-06-23 21:26:43 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2013-06-23 21:27:08 -0700 |
| commit | 9872835cf375caa3a0f5eced7672d943f16b7d7b (patch) | |
| tree | 4d907e812000f0b541dda1728d96a3b7c0a3b666 | |
| parent | e1acaea4f1a2316ac89dce6c79fca483095bdca2 (diff) | |
| parent | 860a5c4b01cd63588ed2eaae76cf0243ca8c3173 (diff) | |
| download | php-git-9872835cf375caa3a0f5eced7672d943f16b7d7b.tar.gz | |
Merge branch 'PHP-5.4' into PHP-5.5
* PHP-5.4:
Fix bug #62759: Buggy grapheme_substr() on edge case
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | ext/intl/grapheme/grapheme_string.c | 22 | ||||
| -rw-r--r-- | ext/intl/tests/bug62759.phpt | 24 |
3 files changed, 46 insertions, 3 deletions
@@ -16,6 +16,9 @@ PHP NEWS . Fixed Bug #65060 (imagecreatefrom... crashes with user streams). (Remi) . Fixed Bug #65084 (imagecreatefromjpeg fails with URL). (Remi) +- Intl: + . Fixed bug #62759: Buggy grapheme_substr() on edge case. (Stas) + - Sockets: . Implemented FR #63472 (Setting SO_BINDTODEVICE with socket_set_option). (Damjan Cvetko) diff --git a/ext/intl/grapheme/grapheme_string.c b/ext/intl/grapheme/grapheme_string.c index 475bbe4184..1b7327e001 100644 --- a/ext/intl/grapheme/grapheme_string.c +++ b/ext/intl/grapheme/grapheme_string.c @@ -434,6 +434,7 @@ PHP_FUNCTION(grapheme_substr) grapheme_substr_ascii((char *)str, str_len, start, length, ZEND_NUM_ARGS(), (char **) &sub_str, &sub_str_len); if ( NULL == sub_str ) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_substr: invalid parameters", 1 TSRMLS_CC ); RETURN_FALSE; } @@ -530,6 +531,15 @@ PHP_FUNCTION(grapheme_substr) RETURN_STRINGL(((char *)sub_str), sub_str_len, 0); } + if(length == 0) { + /* empty length - we've validated start, we can return "" now */ + if (ustr) { + efree(ustr); + } + ubrk_close(bi); + RETURN_EMPTY_STRING(); + } + /* find the end point of the string to return */ if ( length < 0 ) { @@ -554,25 +564,31 @@ PHP_FUNCTION(grapheme_substr) length += iter_val; } + ubrk_close(bi); + if ( UBRK_DONE == sub_str_end_pos) { if(length < 0) { - intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_substr: length not contained in string", 1 TSRMLS_CC ); efree(ustr); - ubrk_close(bi); RETURN_FALSE; } else { sub_str_end_pos = ustr_len; } } + + if(sub_str_start_pos > sub_str_end_pos) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_substr: length is beyond start", 1 TSRMLS_CC ); + + efree(ustr); + RETURN_FALSE; + } sub_str = NULL; status = U_ZERO_ERROR; intl_convert_utf16_to_utf8((char **)&sub_str, &sub_str_len, ustr + sub_str_start_pos, ( sub_str_end_pos - sub_str_start_pos ), &status); efree( ustr ); - ubrk_close( bi ); if ( U_FAILURE( status ) ) { /* Set global error code. */ diff --git a/ext/intl/tests/bug62759.phpt b/ext/intl/tests/bug62759.phpt new file mode 100644 index 0000000000..d4126b752f --- /dev/null +++ b/ext/intl/tests/bug62759.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #62759: Buggy grapheme_substr() on edge case +--SKIPIF-- +<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?> +--FILE-- +<?php +var_dump(substr('deja', 1, -4)); +var_dump(substr('deja', -1, 0)); +var_dump(grapheme_substr('deja', 1, -4)); +var_dump(intl_get_error_message()); +var_dump(grapheme_substr('deja', -1, 0)); +var_dump(grapheme_substr('déjà', 1, -4)); +var_dump(intl_get_error_message()); +var_dump(grapheme_substr('déjà', -1, 0)); +?> +--EXPECT-- +bool(false) +string(0) "" +bool(false) +string(61) "grapheme_substr: invalid parameters: U_ILLEGAL_ARGUMENT_ERROR" +string(0) "" +bool(false) +string(65) "grapheme_substr: length is beyond start: U_ILLEGAL_ARGUMENT_ERROR" +string(0) "" |