After commit
3e62aae1, number_format() returns string with length,
but _php_math_number_format_ex_len() didn't set string length
on nan and inf. This cause segfault when destruct the return value.
tmplen = spprintf(&tmpbuf, 0, "%.*F", dec, d);
if (tmpbuf == NULL || !isdigit((int)tmpbuf[0])) {
+ if (result_len) {
+ *result_len = tmplen;
+ }
+
return tmpbuf;
}
number_format(1e80, 0, '', ' ');
number_format(1e300, 0, '', ' ');
number_format(1e320, 0, '', ' ');
-number_format(1e1000, 0, '', ' ');
+$num = number_format(1e1000, 0, '', ' ');
+var_dump(strlen($num) == 3); // $num == 'inf'
echo "Done\n";
?>
--EXPECT--
+bool(true)
Done