Apply Matt W's patch to only allow ASCII digits and not use u_digit().

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 0345650af1d32fba4f42f41e118e9ed3c4e65f4a..a55be32d0e7bac65f39095e1ab26b8dd0bd9c2b4 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1880,35 +1880,33 @@ ZEND_API ulong zend_hash_next_free_element(HashTable *ht)
        } while (0);                                                                                                                                            \
 }
 
-#define HANDLE_U_NUMERIC(key, length, func) {                                                                                          \
-       register UChar *tmp=key;                                                                                                                                \
-       register int val; \
+#define HANDLE_U_NUMERIC(key, length, func) {                                                                                  \
+       register UChar *tmp=key;                                                                                                                        \
                                                                                                                                                                                \
-       if (*tmp=='-') {                                                                                                                                        \
+       if (*tmp==0x2D /*'-'*/) {                                                                                                                       \
                tmp++;                                                                                                                                                  \
        }                                                                                                                                                                       \
-       if ((val = u_digit(*tmp, 10)) >= 0) do { /* possibly a numeric index */                                 \
-               UChar *end=key+length-1;                                                                                                                        \
+       if ((*tmp>=0x30 /*'0'*/ && *tmp<=0x39 /*'9'*/)) do { /* possibly a numeric index */     \
+               UChar *end=key+length-1;                                                                                                                \
                long idx;                                                                                                                                               \
                                                                                                                                                                                \
-               if (val==0 && length>2) { /* don't accept numbers with leading zeros */ \
+               if (*tmp++==0x30 && length>2) { /* don't accept numbers with leading zeros */   \
                        break;                                                                                                                                          \
-               } \
-               tmp++;                                                                                                                                  \
+               }                                                                                                                                                               \
                while (tmp<end) {                                                                                                                               \
-                       if (u_digit(*tmp, 10) < 0) {                                                                                    \
+                       if (!(*tmp>=0x30 /*'0'*/ && *tmp<=0x39 /*'9'*/)) {                                                      \
                                break;                                                                                                                                  \
                        }                                                                                                                                                       \
                        tmp++;                                                                                                                                          \
                }                                                                                                                                                               \
                if (tmp==end && *tmp==0) { /* a numeric index */                                                                \
-                       if (*key=='-') {                                                                                                                        \
-                               idx = zend_u_strtol(key, NULL, 10);                                                                                     \
+                       if (*key==0x2D /*'-'*/) {                                                                                                       \
+                               idx = zend_u_strtol(key, NULL, 10);                                                                             \
                                if (idx!=LONG_MIN) {                                                                                                    \
                                        return func;                                                                                                            \
                                }                                                                                                                                               \
                        } else {                                                                                                                                        \
-                               idx = zend_u_strtol(key, NULL, 10);                                                                                     \
+                               idx = zend_u_strtol(key, NULL, 10);                                                                             \
                                if (idx!=LONG_MAX) {                                                                                                    \
                                        return func;                                                                                                            \
                                }                                                                                                                                               \

diff --git a/Zend/zend_strtol.c b/Zend/zend_strtol.c
index b34be0be7242ad29eacf90aed4de3f852dbde761..3afe5fd7122d03ca20e054e3e276b24a18a3eb38 100644 (file)
--- a/Zend/zend_strtol.c
+++ b/Zend/zend_strtol.c
@@ -55,7 +55,6 @@ zend_u_strtol(nptr, endptr, base)
        register UChar c;
        register unsigned long cutoff;
        register int neg = 0, any, cutlim;
-       register int val;
 
        /*
         * Skip white space and pick up leading +/- sign if any.
@@ -65,20 +64,20 @@ zend_u_strtol(nptr, endptr, base)
        do {
                c = *s++;
        } while (u_isspace(c));
-       if (c == '-') {
+       if (c == 0x2D /*'-'*/) {
                neg = 1;
                c = *s++;
-       } else if (c == '+')
+       } else if (c == 0x2B /*'+'*/)
                c = *s++;
        if ((base == 0 || base == 16) &&
-           (c == '0')
-                && (*s == 'x' || *s == 'X')) {
+           (c == 0x30 /*'0'*/)
+                && (*s == 0x78 /*'x'*/ || *s == 0x58 /*'X'*/)) {
                c = s[1];
                s += 2;
                base = 16;
        }
        if (base == 0)
-               base = (c == '0') ? 8 : 10;
+               base = (c == 0x30 /*'0'*/) ? 8 : 10;
 
        /*
         * Compute the cutoff value between legal numbers and illegal
@@ -101,14 +100,23 @@ zend_u_strtol(nptr, endptr, base)
        cutlim = cutoff % (unsigned long)base;
        cutoff /= (unsigned long)base;
        for (acc = 0, any = 0;; c = *s++) {
-               if ((val = u_digit(c, base)) < 0)
+               if (c >= 0x30 /*'0'*/ && c <= 0x39 /*'9'*/)
+                       c -= 0x30 /*'0'*/;
+               else if (c >= 0x41 /*'A'*/ && c <= 0x5A /*'Z'*/)
+                       c -= 0x41 /*'A'*/ - 10;
+               else if (c >= 0x61 /*'a'*/ && c <= 0x7A /*'z'*/)
+                       c -= 0x61 /*'a'*/ - 10;
+               else
                        break;
-               if (any < 0 || acc > cutoff || (acc == cutoff && val > cutlim))
+               if (c >= base)
+                       break;
+
+               if (any < 0 || acc > cutoff || (acc == cutoff && c > cutlim))
                        any = -1;
                else {
                        any = 1;
                        acc *= base;
-                       acc += val;
+                       acc += c;
                }
        }
        if (any < 0) {
@@ -116,7 +124,7 @@ zend_u_strtol(nptr, endptr, base)
                errno = ERANGE;
        } else if (neg)
                acc = -acc;
-       if (endptr != 0)
+       if (endptr != NULL)
                *endptr = (UChar *)(any ? s - 1 : nptr);
        return (acc);
 }