Fixed some odd behaviours of range()

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 821c71c5ea0fb5011d5254428ea04a9a9b1bf2b9..0ee5f9f8e88852352cc7e2614ffac6b8b9a351f0 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1435,19 +1435,29 @@ PHP_FUNCTION(range)
 
        /* If the range is given as strings, generate an array of characters. */
        if (Z_TYPE_P(zlow) == IS_STRING && Z_TYPE_P(zhigh) == IS_STRING) {
-               char *low, *high;
+               unsigned char *low, *high;
 
                convert_to_string_ex(&zlow);
                convert_to_string_ex(&zhigh);
-               low = Z_STRVAL_P(zlow);
-               high = Z_STRVAL_P(zhigh);
+               low = (unsigned char *)Z_STRVAL_P(zlow);
+               high = (unsigned char *)Z_STRVAL_P(zhigh);
 
                if (*low > *high) {             /* Negative steps */
-                       for (; *low >= *high; (*low) -= step) {
+                       if (*low - *high < step || step <= 0) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "step exceeds the specified range");
+                               zval_dtor(return_value);
+                               RETURN_FALSE;
+                       }
+                       for (; *low >= *high; (*low) -= (unsigned int)step) {
                                add_next_index_stringl(return_value, low, 1, 1);
                        }
                } else {                                /* Positive steps */
-                       for (; *low <= *high; (*low) += step) {
+                       if (*high - *low < step || step <= 0) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "step exceeds the specified range");
+                               zval_dtor(return_value);
+                               RETURN_FALSE;
+                       }
+                       for (; *low <= *high; (*low) += (unsigned int)step) {
                                add_next_index_stringl(return_value, low, 1, 1);
                        }
                }
@@ -1460,10 +1470,20 @@ PHP_FUNCTION(range)
                high = Z_LVAL_P(zhigh);
 
                if (low > high) {               /* Negative steps */
+                       if (low - high < step || step <= 0) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "step exceeds the specified range");
+                               zval_dtor(return_value);
+                               RETURN_FALSE;
+                       }
                        for (; low >= high; low -= step) {
                                add_next_index_long(return_value, low);
                        }       
                } else {                                /* Positive steps */
+                       if (high - low < step || step <= 0) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "step exceeds the specified range");
+                               zval_dtor(return_value);
+                               RETURN_FALSE;
+                       }
                        for (; low <= high; low += step) {
                                add_next_index_long(return_value, low);
                        }