diff options
| author | Thomas Punt <tpunt@hotmail.co.uk> | 2016-04-15 23:13:50 +0100 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-05-16 19:15:40 +0200 |
| commit | 39052d4d750ee0b7e56fd39edecd860b1a37ac57 (patch) | |
| tree | de79c596ab47b6a71d5730e2c4128f24b92c6a22 /ext/standard/array.c | |
| parent | 6f4860545bde2542a7b73b37707477693a0707bb (diff) | |
| download | php-git-39052d4d750ee0b7e56fd39edecd860b1a37ac57.tar.gz | |
Resolve bug #72017
Diffstat (limited to 'ext/standard/array.c')
| -rw-r--r-- | ext/standard/array.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/ext/standard/array.c b/ext/standard/array.c index 9e21295d85..0800ac017c 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -2104,7 +2104,7 @@ PHP_FUNCTION(array_fill_keys) php_error_docref(NULL, E_WARNING, "The supplied range exceeds the maximum array size: start=%0.0f end=%0.0f", end, start); \ RETURN_FALSE; \ } \ - size = (uint32_t)__calc_size; \ + size = (uint32_t)round(__calc_size); \ array_init_size(return_value, size); \ zend_hash_real_init(Z_ARRVAL_P(return_value), 1); \ } while (0) @@ -2216,7 +2216,7 @@ PHP_FUNCTION(range) zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &tmp); } } else if (Z_TYPE_P(zlow) == IS_DOUBLE || Z_TYPE_P(zhigh) == IS_DOUBLE || is_step_double) { - double low, high; + double low, high, element; uint32_t i, size; double_str: low = zval_get_double(zlow); @@ -2237,8 +2237,8 @@ double_str: RANGE_CHECK_DOUBLE_INIT_ARRAY(low, high); ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) { - for (i = 0; i < size; ++i) { - Z_DVAL(tmp) = low - (i * step); + for (i = 0; i < size && (element = low - (i * step)) <= low && element >= high; ++i) { + Z_DVAL(tmp) = element; ZEND_HASH_FILL_ADD(&tmp); } } ZEND_HASH_FILL_END(); @@ -2251,8 +2251,8 @@ double_str: RANGE_CHECK_DOUBLE_INIT_ARRAY(high, low); ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) { - for (i = 0; i < size; ++i) { - Z_DVAL(tmp) = low + (i * step); + for (i = 0; i < size && (element = low + (i * step)) <= high && element >= low; ++i) { + Z_DVAL(tmp) = element; ZEND_HASH_FILL_ADD(&tmp); } } ZEND_HASH_FILL_END(); |