- Fixed bug #53512 (NumberFormatter::setSymbol crash on bogus $attr values)

diff --git a/ext/intl/formatter/formatter_attr.c b/ext/intl/formatter/formatter_attr.c
index 851b2b310ebc73c1d7ebd54b9377759770086bc1..46d61fb1fce5807b5934716e39bbfbff34ec6a44 100755 (executable)
--- a/ext/intl/formatter/formatter_attr.c
+++ b/ext/intl/formatter/formatter_attr.c
@@ -311,6 +311,11 @@ PHP_FUNCTION( numfmt_set_symbol )
 
                RETURN_FALSE;
        }
+       
+       if (symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0) {
+               intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "numfmt_set_symbol: invalid symbol value", 0 TSRMLS_CC );
+               RETURN_FALSE;
+       }
 
        /* Fetch the object. */
        FORMATTER_METHOD_FETCH_OBJECT;