mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-27 20:03:40 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix #79212: NumberFormatter::format() may detect wrong type

Browse Source 
We have to convert to number *before* detecting the type, to cater to
internal objects implementing `cast_object`.

We also get rid of the fallback behavior of using `FORMAT_TYPE_INT32`,
because that can no longer happen; after `convert_scalar_to_number_ex`
the type is either `IS_LONG` or `IS_DOUBLE`.  We cater explicitly to
the `IS_ARRAY` case what also avoids triggering a type confusion when
`::TYPE_INT64` is passed as `$type`.
This commit is contained in:
Christoph M. Becker 2020-02-02 13:38:34 +01:00
parent ef1e4891b4
commit c2935499b1
3 changed files with 36 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@ -14,6 +14,9 @@ PHP NEWS
. Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()).
(cmb)
-Intl:
. Fixed bug #79212 (NumberFormatter::format() may detect wrong type). (cmb)
- MBString:
. Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). (cmb)

30
ext/intl/formatter/formatter_format.c
View File

@ -53,23 +53,23 @@ PHP_FUNCTION( numfmt_format )
/* Fetch the object. */
FORMATTER_METHOD_FETCH_OBJECT;
if(type == FORMAT_TYPE_DEFAULT) {
if(Z_TYPE_P(number) == IS_STRING) {
convert_scalar_to_number_ex(number);
}
if(Z_TYPE_P(number) == IS_LONG) {
/* take INT32 on 32-bit, int64 on 64-bit */
type = (sizeof(zend_long) == 8)?FORMAT_TYPE_INT64:FORMAT_TYPE_INT32;
} else if(Z_TYPE_P(number) == IS_DOUBLE) {
type = FORMAT_TYPE_DOUBLE;
} else {
type = FORMAT_TYPE_INT32;
}
if(Z_TYPE_P(number) != IS_ARRAY) {
convert_scalar_to_number_ex(number);
} else {
convert_to_long(number);
}
if(Z_TYPE_P(number) != IS_DOUBLE && Z_TYPE_P(number) != IS_LONG) {
convert_scalar_to_number(number );
if(type == FORMAT_TYPE_DEFAULT) {
switch(Z_TYPE_P(number)) {
case IS_LONG:
/* take INT32 on 32-bit, int64 on 64-bit */
type = (sizeof(zend_long) == 8)?FORMAT_TYPE_INT64:FORMAT_TYPE_INT32;
break;
case IS_DOUBLE:
type = FORMAT_TYPE_DOUBLE;
break;
EMPTY_SWITCH_DEFAULT_CASE();
}
}
switch(type) {

18
ext/intl/tests/bug79212.phpt Normal file
View File

@ -0,0 +1,18 @@
--TEST--
Bug #79212 (NumberFormatter::format() may detect wrong type)
--SKIPIF--
<?php
if (!extension_loaded('intl')) die('skip intl extension not available');
if (!extension_loaded('gmp')) die('skip gmp extension not available');
?>
--FILE--
<?php
$fmt = new NumberFormatter('en_US', NumberFormatter::PATTERN_DECIMAL);
var_dump($fmt->format(gmp_init('823749273428379492374')));
$fmt = new NumberFormatter('en_US', NumberFormatter::PATTERN_DECIMAL);
var_dump($fmt->format([1], NumberFormatter::TYPE_INT64));
?>
--EXPECT--
string(21) "823749273428379400000"
string(1) "1"