Check that _php_math_basetolong result fits long (by request from Troels Arvin)

diff --git a/ext/standard/math.c b/ext/standard/math.c
index bfdade04caa9895fa1f1d63e335561f57d8714c3..89c529623ce280f58b051d9f65a733df6244daa4 100644 (file)
--- a/ext/standard/math.c
+++ b/ext/standard/math.c
@@ -752,6 +752,10 @@ _php_math_basetolong(zval *arg, int base) {
                if (digit >= base) {
                        continue;
                }
+               if(!mult || digit > LONG_MAX/mult || num > LONG_MAX-mult*digit) {
+                       php_error(E_WARNING, "base_to_long: number '%s' is too big to fit in long", s);
+                       return LONG_MAX;
+               }
                num += mult * digit;
        }