Fixed bug #23225 (money_format() didn't handle erroneous return of strfmon)

# Initial patch proposed by marcot@tabini.ca

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 9e99ccff6c259bbe10d698a153ce1e71fd89aaf1..0f1780a3cf374f4bc7c13752fb6ab63cea23ea2a 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4372,7 +4372,10 @@ PHP_FUNCTION(money_format)
 
        str_len = format_len + 1024;
        str = emalloc(str_len);
-       str_len = strfmon(str, str_len, format, value);         
+       if ((str_len = strfmon(str, str_len, format, value)) < 0) {
+               efree(str);
+               RETURN_FALSE;
+       }
        str[str_len] = 0;
 
        RETURN_STRINGL(erealloc(str, str_len + 1), str_len, 0);