Fixed bug #24220 (range() didn't handle numeric strings correctly)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 597daf25083c39582ca8b15b1c9b3e4fb5b6f0e4..366d35eaf357d0bb12d1f52abed98d5f3fd99cdb 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1428,7 +1428,7 @@ PHP_FUNCTION(range)
        /* allocate an array for return */
        array_init(return_value);
 
-       if (Z_TYPE_PP(zlow)==IS_STRING && Z_TYPE_PP(zhigh)==IS_STRING) {
+       if (Z_TYPE_PP(zlow) == IS_STRING && Z_TYPE_PP(zhigh) == IS_STRING && Z_STRLEN_PP(zlow) == 1 && Z_STRLEN_PP(zhigh) == 1) {
                unsigned char low, high;
                low = *((unsigned char *)Z_STRVAL_PP(zlow));
                high = *((unsigned char *)Z_STRVAL_PP(zhigh));