MFH: Fixed bug #30276 (Possible crash in ctype_digit on large numbers).

diff --git a/NEWS b/NEWS
index 37badf8ff32c7855ddd5f275cd9d5288cabdfaf1..fa8964448b096c98f8ec88079c9f9221722e3eed 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP 4                                                                      NEWS
 ?? ??? 2004, Version 4.3.10
 - Backported Marcus' foreach() speedup patch from PHP 5.x. (Derick)
 - Fixed potential problems with unserializing invalid serialize data. (Marcus)
+- Fixed bug #30276 (Possible crash in ctype_digit on large numbers). (Ilia)
 - Fixed bug #30224 (Sybase date strings are sometimes not null terminated).
   (Ilia)
 - Fixed bug #30057 (did not detect IPV6 on FreeBSD 4.1). (Wez)

diff --git a/ext/ctype/ctype.c b/ext/ctype/ctype.c
index 8336283a42f48b0742aa1e4a2b89963bfc000b93..5f5f83f7543797d3f29ed92e37cf06c1c4604883 100644 (file)
--- a/ext/ctype/ctype.c
+++ b/ext/ctype/ctype.c
@@ -99,7 +99,7 @@ PHP_MINFO_FUNCTION(ctype)
        case IS_LONG: \
                if (Z_LVAL_P(c) <= 255 && Z_LVAL_P(c) >= 0) { \
                        RETURN_BOOL(iswhat(Z_LVAL_P(c))); \
-               } else if (Z_LVAL_P(c) >= -128) { \
+               } else if (Z_LVAL_P(c) >= -128 && Z_LVAL_P(c) < 0) { \
                        RETURN_BOOL(iswhat(Z_LVAL_P(c) + 256)); \
                } \
                SEPARATE_ZVAL(&c);      \