MFH: Fixed bug #30276 (Possible crash in ctype_digit on large numbers).

diff --git a/NEWS b/NEWS
index 9d05674e75ece9bd80bcc1123a85064722db1ec2..ce63fc90347aab39798add8cd14c5ee8b6c08dbe 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, PHP 5.0.3
+- Fixed bug #30276 (Possible crash in ctype_digit on large numbers). (Ilia)
 - Fixed bug #30224 (Sybase date strings are sometimes not null terminated).
   (Ilia)
 - Fixed bug #30147 (OO sqlite_fetch_object did not reset error handler). (Wez)

diff --git a/ext/ctype/ctype.c b/ext/ctype/ctype.c
index b16324042dd5299cfdcaa06fe17d2cde0c6bc4bd..78f6d293e3b7c8c68bd960e9d19480869c1707bd 100644 (file)
--- a/ext/ctype/ctype.c
+++ b/ext/ctype/ctype.c
@@ -99,7 +99,7 @@ PHP_MINFO_FUNCTION(ctype)
        case IS_LONG: \
                if (Z_LVAL_P(c) <= 255 && Z_LVAL_P(c) >= 0) { \
                        RETURN_BOOL(iswhat(Z_LVAL_P(c))); \
-               } else if (Z_LVAL_P(c) >= -128) { \
+               } else if (Z_LVAL_P(c) >= -128 && Z_LVAL_P(c) < 0) { \
                        RETURN_BOOL(iswhat(Z_LVAL_P(c) + 256)); \
                } \
                SEPARATE_ZVAL(&c);      \