diff options
| author | Gustavo André dos Santos Lopes <cataphract@php.net> | 2011-02-21 06:53:24 +0000 |
|---|---|---|
| committer | Gustavo André dos Santos Lopes <cataphract@php.net> | 2011-02-21 06:53:24 +0000 |
| commit | 2a6968e43ae4dc6b91c44f59daa94b3a2b26fd51 (patch) | |
| tree | 1e78200fc3e0fc0d32e11987fe223a803568166a /main/spprintf.c | |
| parent | b21f62eb2d833bd435a13289a85e29c559ee9d74 (diff) | |
| download | php-git-2a6968e43ae4dc6b91c44f59daa94b3a2b26fd51.tar.gz | |
- Fixed bug #54055 (buffer overrun with high values for precision ini
setting).
#This fix (for g/G/k/H modes) is done at a different level than that for the
#modes e/E/f/F, at a bit higher level and therefore with less coverage. I
#chose this because it addresses the problem where it is -- the calling function
#that passes a buffer too small to php_gcvt.
Diffstat (limited to 'main/spprintf.c')
| -rw-r--r-- | main/spprintf.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/main/spprintf.c b/main/spprintf.c index 635d17ca17..8c90fda378 100644 --- a/main/spprintf.c +++ b/main/spprintf.c @@ -285,10 +285,6 @@ static void xbuf_format_converter(smart_str *xbuf, const char *fmt, va_list ap) /* * Check if a precision was specified - * - * XXX: an unreasonable amount of precision may be specified - * resulting in overflow of num_buf. Currently we - * ignore this possibility. */ if (*fmt == '.') { adjust_precision = YES; @@ -302,6 +298,10 @@ static void xbuf_format_converter(smart_str *xbuf, const char *fmt, va_list ap) precision = 0; } else precision = 0; + + if (precision > FORMAT_CONV_MAX_PRECISION) { + precision = FORMAT_CONV_MAX_PRECISION; + } } else adjust_precision = NO; } else |