1 files changed, 21 insertions, 18 deletions

diff --git a/ext/standard/math.c b/ext/standard/math.c
index 21c730c928..302fbdae48 100644
--- a/ext/standard/math.c
+++ b/ext/standard/math.c
@@ -620,7 +620,7 @@ PHP_FUNCTION(pow)
 
 		/* calculate pow(long,long) in O(log exp) operations, bail if overflow */
 		while (i >= 1) {
-			int overflow;
+			long overflow;
 			double dval = 0.0;
 
 			if (i % 2) {
@@ -1094,6 +1094,11 @@ PHP_FUNCTION(base_convert)
 */
 PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char thousand_sep)
 {
+	return _php_math_number_format_ex(d, dec, &dec_point, 1, &thousand_sep, 1);
+}
+
+PHPAPI char *_php_math_number_format_ex(double d, int dec, char *dec_point, size_t dec_point_len, char *thousand_sep, size_t thousand_sep_len)
+{
 	char *tmpbuf = NULL, *resbuf;
 	char *s, *t;  /* source, target */
 	char *dp;
@@ -1133,7 +1138,7 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho
 
 	/* allow for thousand separators */
 	if (thousand_sep) {
-		integral += (integral-1) / 3;
+		integral += thousand_sep_len * ((integral-1) / 3);
 	}
 	
 	reslen = integral;
@@ -1142,7 +1147,7 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho
 		reslen += dec;
 
 		if (dec_point) {
-			reslen++;
+			reslen += dec_point_len;
 		}
 	}
 
@@ -1178,7 +1183,8 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho
 
 		/* add decimal point */
 		if (dec_point) {
-			*t-- = dec_point;
+			t -= dec_point_len;
+			memcpy(t + 1, dec_point, dec_point_len);
 		}
 	}
 
@@ -1187,7 +1193,8 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho
 	while(s >= tmpbuf) {
 		*t-- = *s--;
 		if (thousand_sep && (++count%3)==0 && s>=tmpbuf) {
-			*t-- = thousand_sep;
+			t -= thousand_sep_len;
+			memcpy(t + 1, thousand_sep, thousand_sep_len);
 		}
 	}
 
@@ -1224,21 +1231,17 @@ PHP_FUNCTION(number_format)
 		RETURN_STRING(_php_math_number_format(num, dec, dec_point_chr, thousand_sep_chr), 0);
 		break;
 	case 4:
-		if (dec_point != NULL) {
-			if (dec_point_len) {
-				dec_point_chr = dec_point[0];
-			} else {
-				dec_point_chr = 0;
-			}
+		if (dec_point == NULL) {
+			dec_point = &dec_point_chr;
+			dec_point_len = 1;
 		}
-		if (thousand_sep != NULL) {
-			if (thousand_sep_len) {
-				thousand_sep_chr = thousand_sep[0];
-			} else {
-				thousand_sep_chr = 0;	
-			}
+
+		if (thousand_sep == NULL) {
+			thousand_sep = &thousand_sep_chr;
+			thousand_sep_len = 1;
 		}
-		RETURN_STRING(_php_math_number_format(num, dec, dec_point_chr, thousand_sep_chr), 0);
+
+		RETURN_STRING(_php_math_number_format_ex(num, dec, dec_point, dec_point_len, thousand_sep, thousand_sep_len), 0);
 		break;
 	default:
 		WRONG_PARAM_COUNT;