dmitry Mon Jun 18 13:39:02 2007 UTC Modified files: /php-src/ext/standard string.c /php-src/ext/standard/tests/strings bug40754.phpt Log: Fixed crash in substr_compare() Fixed error messages http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.643&r2=1.644&diff_format=u Index: php-src/ext/standard/string.c diff -u php-src/ext/standard/string.c:1.643 php-src/ext/standard/string.c:1.644 --- php-src/ext/standard/string.c:1.643 Mon Jun 18 11:50:41 2007 +++ php-src/ext/standard/string.c Mon Jun 18 13:39:02 2007 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: string.c,v 1.643 2007/06/18 11:50:41 dmitry Exp $ */ +/* $Id: string.c,v 1.644 2007/06/18 13:39:02 dmitry Exp $ */ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ @@ -7208,7 +7208,7 @@ tmp = (char *)p + length; } if (tmp > endp) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset value %ld exceeds string length", offset); + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length value %ld exceeds string length", length); RETURN_FALSE; } else { endp = tmp; @@ -7888,8 +7888,13 @@ offset = (offset < 0) ? 0 : offset; } - if ((offset + len) > s1_len) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "The specified segment exceeds string length"); + if(offset > s1_len) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "The start position cannot exceed initial string length"); + RETURN_FALSE; + } + + if(len > s1_len - offset) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "The length cannot exceed initial string length"); RETURN_FALSE; } http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/strings/bug40754.phpt?r1=1.2&r2=1.3&diff_format=u Index: php-src/ext/standard/tests/strings/bug40754.phpt diff -u php-src/ext/standard/tests/strings/bug40754.phpt:1.2 php-src/ext/standard/tests/strings/bug40754.phpt:1.3 --- php-src/ext/standard/tests/strings/bug40754.phpt:1.2 Tue May 29 20:11:23 2007 +++ php-src/ext/standard/tests/strings/bug40754.phpt Mon Jun 18 13:39:02 2007 @@ -32,25 +32,25 @@ bool(false) bool(false) -Warning: substr_count(): Offset value 2147483647 exceeds string length. in %s on line %d +Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d bool(false) Warning: substr_compare(): The start position cannot exceed initial string length in %s on line %d bool(false) -Warning: stripos(): Offset not contained in string. in %s on line %d +Warning: stripos(): Offset not contained in string in %s on line %d bool(false) -Warning: substr_count(): Offset value 2147483647 exceeds string length. in %s on line %d +Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d bool(false) -Warning: substr_count(): Length value 2147483647 exceeds string length. in %s on line %d +Warning: substr_count(): Length value 2147483647 exceeds string length in %s on line %d bool(false) -Warning: strpos(): Offset not contained in string. in %s on line %d +Warning: strpos(): Offset not contained in string in %s on line %d bool(false) -Warning: stripos(): Offset not contained in string. in %s on line %d +Warning: stripos(): Offset not contained in string in %s on line %d bool(false) Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d @@ -61,3 +61,38 @@ int(2) string(8) "abcdeabc" bool(false) +--UEXPECTF-- +unicode(4) "bcde" +bool(false) +bool(false) +bool(false) + +Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d +bool(false) + +Warning: substr_compare(): The start position cannot exceed initial string length in %s on line %d +bool(false) + +Warning: stripos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d +bool(false) + +Warning: substr_count(): Length value 2147483647 exceeds string length in %s on line %d +bool(false) + +Warning: strpos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: stripos(): Offset not contained in string in %s on line %d +bool(false) + +Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) + +Notice: strripos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) +int(2) +unicode(8) "abcdeabc" +bool(false)
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php