dmitry Tue Mar 31 10:02:51 2009 UTC Modified files: /php-src/ext/filter logical_filters.c /php-src/ext/filter/tests bug47745.phpt Log: Fixed bug #47745 (FILTER_VALIDATE_INT doesn't allow minimum integer) http://cvs.php.net/viewvc.cgi/php-src/ext/filter/logical_filters.c?r1=1.36&r2=1.37&diff_format=u Index: php-src/ext/filter/logical_filters.c diff -u php-src/ext/filter/logical_filters.c:1.36 php-src/ext/filter/logical_filters.c:1.37 --- php-src/ext/filter/logical_filters.c:1.36 Wed Mar 25 18:52:08 2009 +++ php-src/ext/filter/logical_filters.c Tue Mar 31 10:02:51 2009 @@ -17,7 +17,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: logical_filters.c,v 1.36 2009/03/25 18:52:08 iliaa Exp $ */ +/* $Id: logical_filters.c,v 1.37 2009/03/31 10:02:51 dmitry Exp $ */ #include "php_filter.h" #include "filter_private.h" @@ -74,14 +74,12 @@ static int php_filter_parse_int(const char *str, unsigned int str_len, long *ret TSRMLS_DC) { /* {{{ */ long ctx_value; - long sign = 1; + long sign = 0; const char *end = str + str_len; - double dval; - long overflow; switch (*str) { case '-': - sign = -1; + sign = 1; case '+': str++; default: @@ -95,22 +93,29 @@ return -1; } + if ((end - str > MAX_LENGTH_OF_LONG - 1) /* number too long */ + || (SIZEOF_LONG == 4 && end - str == MAX_LENGTH_OF_LONG - 1 && *str > '2')) { + /* overflow */ + return -1; + } + while (str < end) { if (*str >= '0' && *str <= '9') { - ZEND_SIGNED_MULTIPLY_LONG(ctx_value, 10, ctx_value, dval, overflow); - if (overflow) { - return -1; - } - ctx_value += ((*(str++)) - '0'); - if (ctx_value & LONG_SIGN_MASK) { - return -1; - } + ctx_value = (ctx_value * 10) + (*(str++) - '0'); \ } else { return -1; } } + if (sign) { + ctx_value = -ctx_value; + if (ctx_value > 0) { /* overflow */ + return -1; + } + } else if (ctx_value < 0) { /* overflow */ + return -1; + } - *ret = ctx_value * sign; + *ret = ctx_value; return 1; } /* }}} */ http://cvs.php.net/viewvc.cgi/php-src/ext/filter/tests/bug47745.phpt?r1=1.1&r2=1.2&diff_format=u Index: php-src/ext/filter/tests/bug47745.phpt diff -u /dev/null php-src/ext/filter/tests/bug47745.phpt:1.2 --- /dev/null Tue Mar 31 10:02:51 2009 +++ php-src/ext/filter/tests/bug47745.phpt Tue Mar 31 10:02:51 2009 @@ -0,0 +1,11 @@ +--TEST-- +Bug #47745 (FILTER_VALIDATE_INT doesn't allow minimum integer) +--FILE-- +<?php +$s = (string)(-PHP_INT_MAX-1); +var_dump(intval($s)); +var_dump(filter_var($s, FILTER_VALIDATE_INT)); +?> +--EXPECTF-- +int(-%d) +int(-%d)
-- PHP CVS Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php