diff options
| author | Reeze Xia <reeze.xia@gmail.com> | 2012-07-17 23:01:20 +0800 |
|---|---|---|
| committer | Gustavo André dos Santos Lopes <cataphract@php.net> | 2012-07-17 23:08:11 +0200 |
| commit | b47d6b32ba8d6dc1b9d1fc91a83eef29a28363c5 (patch) | |
| tree | a84b26c7f492e7e9aa79513ba0c308602c1e7a27 /ext | |
| parent | d0e58bf6eb54676a711d98d3b72a13e828e2deef (diff) | |
| download | php-git-b47d6b32ba8d6dc1b9d1fc91a83eef29a28363c5.tar.gz | |
Fix test fails: ext/standard/tests/general_functions/bug27678.phpt
After commit 3e62aae1, number_format() returns string with length,
but _php_math_number_format_ex_len() didn't set string length
on nan and inf. This cause segfault when destruct the return value.
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/standard/math.c | 4 | ||||
| -rw-r--r-- | ext/standard/tests/general_functions/bug27678.phpt | 4 |
2 files changed, 7 insertions, 1 deletions
diff --git a/ext/standard/math.c b/ext/standard/math.c index b3e8c6f086..6e934a3857 100644 --- a/ext/standard/math.c +++ b/ext/standard/math.c @@ -1120,6 +1120,10 @@ static char *_php_math_number_format_ex_len(double d, int dec, char *dec_point, tmplen = spprintf(&tmpbuf, 0, "%.*F", dec, d); if (tmpbuf == NULL || !isdigit((int)tmpbuf[0])) { + if (result_len) { + *result_len = tmplen; + } + return tmpbuf; } diff --git a/ext/standard/tests/general_functions/bug27678.phpt b/ext/standard/tests/general_functions/bug27678.phpt index 5db5890a1c..6f95509e14 100644 --- a/ext/standard/tests/general_functions/bug27678.phpt +++ b/ext/standard/tests/general_functions/bug27678.phpt @@ -6,9 +6,11 @@ Bug #27678 (number_format() crashes with large numbers) number_format(1e80, 0, '', ' '); number_format(1e300, 0, '', ' '); number_format(1e320, 0, '', ' '); -number_format(1e1000, 0, '', ' '); +$num = number_format(1e1000, 0, '', ' '); +var_dump(strlen($num) == 3); // $num == 'inf' echo "Done\n"; ?> --EXPECT-- +bool(true) Done |