archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-20 17:34:35 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fix test fails: ext/standard/tests/general_functions/bug27678.phpt

Browse source 
After commit 3e62aae1, number_format() returns string with length,
but _php_math_number_format_ex_len() didn't set string length
on nan and inf. This cause segfault when destruct the return value.
This commit is contained in:
Reeze Xia 2012-07-17 23:01:20 +08:00 • committed by Gustavo André dos Santos Lopes
parent d0e58bf6eb
commit b47d6b32ba
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
ext/standard/math.c
View file

@ -1120,6 +1120,10 @@ static char *_php_math_number_format_ex_len(double d, int dec, char *dec_point,
tmplen = spprintf(&tmpbuf, 0, "%.*F", dec, d); tmplen = spprintf(&tmpbuf, 0, "%.*F", dec, d);
if (tmpbuf == NULL || !isdigit((int)tmpbuf[0])) { if (tmpbuf == NULL || !isdigit((int)tmpbuf[0])) {
if (result_len) {
*result_len = tmplen;
}
return tmpbuf; return tmpbuf;
} }

4
ext/standard/tests/general_functions/bug27678.phpt
View file

@ -6,9 +6,11 @@ Bug #27678 (number_format() crashes with large numbers)
number_format(1e80, 0, '', ' '); number_format(1e80, 0, '', ' ');
number_format(1e300, 0, '', ' '); number_format(1e300, 0, '', ' ');
number_format(1e320, 0, '', ' '); number_format(1e320, 0, '', ' ');
number_format(1e1000, 0, '', ' '); $num = number_format(1e1000, 0, '', ' ');
var_dump(strlen($num) == 3); // $num == 'inf'
echo "Done\n"; echo "Done\n";
?> ?>
--EXPECT-- --EXPECT--
bool(true)
Done Done