MFH: Fixed str_pad() when passed huge negative pad length.

diff --git a/ext/standard/string.c b/ext/standard/string.c
index cb8fa70ca33377a54eeeeaa979139eaf167d3f2b..4436b5a7aa1d9fde0ea8c190e9a2ce1caee48429 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4746,7 +4746,7 @@ PHP_FUNCTION(str_pad)
 
        /* If resulting string turns out to be shorter than input string,
           we simply copy the input and return. */
-       if (num_pad_chars < 0) {
+       if (Z_LVAL_PP(pad_length) < 0 || num_pad_chars < 0) {
                RETURN_ZVAL(*input, 1, 0);
        }
 

diff --git a/ext/standard/tests/strings/str_pad.phpt b/ext/standard/tests/strings/str_pad.phpt
index 6eaff1514bd4bc1545f17efc87f97e97c1893088..886743a8b707a3c0f810055d2cf579a850adc712 100644 (file)
Binary files a/ext/standard/tests/strings/str_pad.phpt and b/ext/standard/tests/strings/str_pad.phpt differ