Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod, zend_hex_strtod)

diff --git a/NEWS b/NEWS
index 2580ca1cff95975a858007b7403130556dfc6b3f..cbd51b626bee8d7c5f20ab3d6d8b878a0f94fe0e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ PHP                                                                        NEWS
   . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
 
 - Core:
+  . Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod,
+    zend_hex_strtod). (Laruence)
   . Fixed bug #71695 (Global variables are reserved before execution).
     (Laruence)
   . Fixed bug #71629 (Out-of-bounds access in php_url_decode in context

diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
index 0bdb8c08b56ddabc5ce9d0d7caf3067747d9b7f3..22d509e4a79ced44c3a9a65f19ed4ebc776fe8e1 100644 (file)
--- a/Zend/zend_strtod.c
+++ b/Zend/zend_strtod.c
@@ -4417,7 +4417,9 @@ ZEND_API double zend_hex_strtod(const char *str, const char **endptr)
        double value = 0;
 
        if (strlen(str) < 2) {
-               *endptr = str;
+               if (endptr != NULL) {
+                       *endptr = str;
+               }
                return 0.0;
        }
 
@@ -4455,7 +4457,9 @@ ZEND_API double zend_oct_strtod(const char *str, const char **endptr)
        int any = 0;
 
        if (strlen(str) < 1) {
-               *endptr = str;
+               if (endptr != NULL) {
+                       *endptr = str;
+               }
                return 0.0;
        }
 
@@ -4488,7 +4492,9 @@ ZEND_API double zend_bin_strtod(const char *str, const char **endptr)
        int             any = 0;
 
        if (strlen(str) < 2) {
-               *endptr = str;
+               if (endptr != NULL) {
+                       *endptr = str;
+               }
                return 0.0;
        }