]> granicus.if.org Git - php/commitdiff
- Fixed bug #32021: Crash caused by range('', 'z')
authorDerick Rethans <derick@php.net>
Fri, 18 Feb 2005 13:37:23 +0000 (13:37 +0000)
committerDerick Rethans <derick@php.net>
Fri, 18 Feb 2005 13:37:23 +0000 (13:37 +0000)
ext/standard/array.c
ext/standard/tests/array/bug32021.phpt [new file with mode: 0644]

index 270ba0dc50e3a5434febcdcc43b079c9082660e7..9848de248d6cf5f02bc0eb4ab1a66bfc04003367 100644 (file)
@@ -1590,7 +1590,7 @@ PHP_FUNCTION(range)
        array_init(return_value);
 
        /* If the range is given as strings, generate an array of characters. */
-       if (Z_TYPE_P(zlow) == IS_STRING && Z_TYPE_P(zhigh) == IS_STRING) {
+       if (Z_TYPE_P(zlow) == IS_STRING && Z_TYPE_P(zhigh) == IS_STRING && Z_STRLEN_P(zlow) >= 1 && Z_STRLEN_P(zhigh) >= 1) {
                int type1, type2;
                unsigned char *low, *high;
                long lstep = (long) step;
diff --git a/ext/standard/tests/array/bug32021.phpt b/ext/standard/tests/array/bug32021.phpt
new file mode 100644 (file)
index 0000000..5d3b421
--- /dev/null
@@ -0,0 +1,14 @@
+--TEST--
+Bug #32021 (Crash caused by range('', 'z'))
+--FILE--
+<?php
+$foo = range('', 'z');
+var_dump($foo);
+?>
+ALIVE
+--EXPECT--
+array(1) {
+  [0]=>
+  int(0)
+}
+ALIVE