Fix for #73240 - Write out of bounds at number_format

(cherry picked from commit 8259130b6bc752968856b352c9e7f8e03a8c0a8e)
(cherry picked from commit 01280f8deb837a61237a619cffa886d7f8c31963)

diff --git a/ext/standard/math.c b/ext/standard/math.c
index 83145a4dc9bc370a6cff083c83dd57563c0a1acf..753656c56f70237866102f543c8e434203898196 100644 (file)
--- a/ext/standard/math.c
+++ b/ext/standard/math.c
@@ -1139,18 +1139,14 @@ PHPAPI zend_string *_php_math_number_format_ex(double d, int dec, char *dec_poin
 
        /* calculate the length of the return buffer */
        if (dp) {
-               integral = (int)(dp - ZSTR_VAL(tmpbuf));
+               integral = (dp - ZSTR_VAL(tmpbuf));
        } else {
                /* no decimal point was found */
-               integral = (int)ZSTR_LEN(tmpbuf);
+               integral = ZSTR_LEN(tmpbuf);
        }
 
        /* allow for thousand separators */
        if (thousand_sep) {
-               if (integral + thousand_sep_len * ((integral-1) / 3) < integral) {
-                       /* overflow */
-                       php_error_docref(NULL, E_ERROR, "String overflow");
-               }
                integral += thousand_sep_len * ((integral-1) / 3);
        }
 
@@ -1160,10 +1156,6 @@ PHPAPI zend_string *_php_math_number_format_ex(double d, int dec, char *dec_poin
                reslen += dec;
 
                if (dec_point) {
-                       if (reslen + dec_point_len < dec_point_len) {
-                               /* overflow */
-                               php_error_docref(NULL, E_ERROR, "String overflow");
-                       }
                        reslen += dec_point_len;
                }
        }
@@ -1266,6 +1258,7 @@ PHP_FUNCTION(number_format)
                break;
        default:
                WRONG_PARAM_COUNT;
+               break;
        }
 }
 /* }}} */