diff options
| author | Nuno Lopes <nlopess@php.net> | 2012-05-11 12:50:29 -0400 |
|---|---|---|
| committer | Nuno Lopes <nlopess@php.net> | 2012-05-11 13:07:21 -0400 |
| commit | 8b4b70df56e14be0f7172b5cc5f8da44b3272ac3 (patch) | |
| tree | 5707636bae2300958717b13f8a11fde50932cfc5 /ext/standard/math.c | |
| parent | 4458f3bcf65e5826f4cfb8ffd00cd3b8161f37bd (diff) | |
| download | php-git-8b4b70df56e14be0f7172b5cc5f8da44b3272ac3.tar.gz | |
fix stack overflow in php_intlog10abs()
bug uncovered by LLVM/clang's new -fbounds-checking switch
this patch fixes a crash in ext/standard/tests/math/round_large_exp.phpt
Diffstat (limited to 'ext/standard/math.c')
| -rw-r--r-- | ext/standard/math.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ext/standard/math.c b/ext/standard/math.c index 302fbdae48..65187f6fa1 100644 --- a/ext/standard/math.c +++ b/ext/standard/math.c @@ -37,7 +37,7 @@ static inline int php_intlog10abs(double value) { int result; value = fabs(value); - if (value < 1e-8 || value > 1e23) { + if (value < 1e-8 || value > 1e22) { result = (int)floor(log10(value)); } else { static const double values[] = { @@ -46,7 +46,7 @@ static inline int php_intlog10abs(double value) { 1e8, 1e9, 1e10, 1e11, 1e12, 1e13, 1e14, 1e15, 1e16, 1e17, 1e18, 1e19, 1e20, 1e21, 1e22}; /* Do a binary search with 5 steps */ - result = 16; + result = 15; if (value < values[result]) { result -= 8; } else { |