From c28cac404d2d0590ba2811f41331c60d09adbf1e Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 19 Dec 2010 05:07:31 +0000 Subject: [PATCH] Fix bad args to grapheme_extract(), reported by Maksymilian Arciemowicz --- ext/intl/grapheme/grapheme_string.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/ext/intl/grapheme/grapheme_string.c b/ext/intl/grapheme/grapheme_string.c index ba883f34a84..6ad8769619d 100755 --- a/ext/intl/grapheme/grapheme_string.c +++ b/ext/intl/grapheme/grapheme_string.c @@ -799,7 +799,7 @@ PHP_FUNCTION(grapheme_extract) if ( NULL != next ) { if ( !PZVAL_IS_REF(next) ) { - intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_extract: 'next' was not passed by reference", 0 TSRMLS_CC ); RETURN_FALSE; @@ -819,12 +819,18 @@ PHP_FUNCTION(grapheme_extract) } if ( lstart > INT32_MAX || lstart < 0 || lstart >= str_len ) { - - intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_extract: start not contained in string", 1 TSRMLS_CC ); - + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_extract: start not contained in string", 0 TSRMLS_CC ); RETURN_FALSE; } + if ( size > INT32_MAX || size < 0) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_extract: size is invalid", 0 TSRMLS_CC ); + RETURN_FALSE; + } + if (size == 0) { + RETURN_EMPTY_STRING(); + } + /* we checked that it will fit: */ start = (int32_t) lstart;