Fixed bug #77660 (Segmentation fault on break 2147483648)

diff --git a/NEWS b/NEWS
index 37138ed998bfb50b005c98374e1b534d8030f033..65eb3a98514ba331035a137d4cfc22d04a73c2dd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 ?? ??? 2019, PHP 7.2.17
 
 - Core:
+  . Fixed bug #77660 (Segmentation fault on break 2147483648). (Laruence)
   . Fixed bug #77652 (Anonymous classes can lose their interface information).
     (Nikita)
 

diff --git a/Zend/tests/bug77660.phpt b/Zend/tests/bug77660.phpt
new file mode 100644 (file)
index 0000000..94af1f9
--- /dev/null
+++ b/Zend/tests/bug77660.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #77660 (Segmentation fault on break 2147483648)
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
+--FILE--
+<?php
+for(;;) break 2147483648;
+?>
+--EXPECTF--
+Fatal error: Cannot 'break' 2147483648 levels in %sbug77660.php on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 06d00153372e0e6bd353861ede9b6bc474445afb..d0bece72284131330eda9e3f92451fc8d519bc73 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -4508,7 +4508,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
        zend_ast *depth_ast = ast->child[0];
 
        zend_op *opline;
-       int depth;
+       zend_long depth;
 
        ZEND_ASSERT(ast->kind == ZEND_AST_BREAK || ast->kind == ZEND_AST_CONTINUE);
 
@@ -4535,7 +4535,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
                        ast->kind == ZEND_AST_BREAK ? "break" : "continue");
        } else {
                if (!zend_handle_loops_and_finally_ex(depth, NULL)) {
-                       zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' %d level%s",
+                       zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' " ZEND_LONG_FMT " level%s",
                                ast->kind == ZEND_AST_BREAK ? "break" : "continue",
                                depth, depth == 1 ? "" : "s");
                }