From: Moriyoshi Koizumi Date: Sat, 14 Feb 2009 07:35:01 +0000 (+0000) Subject: - MFH: Fix Bug #45923 (mb_st[r]ripos() offset not handled correctly) X-Git-Tag: php-5.2.9RC3~25 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1557e3503439de51be53fc4d28c3e2325382f959;p=php - MFH: Fix Bug #45923 (mb_st[r]ripos() offset not handled correctly) --- diff --git a/NEWS b/NEWS index d33970c042..996b871b8f 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Feb 2009, PHP 5.2.9 +- Fixed Bug #45923 (mb_st[r]ripos() offset not handled correctly). (Moriyoshi) 12 Feb 2009, PHP 5.2.9RC2 - Fixed bug #47353 (crash when creating a lot of objects in object destructor). diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c index a2c117d2a3..907fa272b6 100644 --- a/ext/mbstring/libmbfl/mbfl/mbfilter.c +++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c @@ -905,7 +905,7 @@ mbfl_strpos( } if (offset < 0) { - negative_offset = -offset-1; + negative_offset = -offset - pc.needle_len; offset = 0; } diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c index ffd79f0e91..b1011da945 100644 --- a/ext/mbstring/mbstring.c +++ b/ext/mbstring/mbstring.c @@ -1653,12 +1653,12 @@ PHP_FUNCTION(mb_strpos) } } - if (offset < 0 || (unsigned long)offset > (unsigned long)mbfl_strlen(&haystack)) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset not contained in string."); + if (offset < 0 || offset > mbfl_strlen(&haystack)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset not contained in string"); RETURN_FALSE; } if (needle.len == 0) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty delimiter."); + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty delimiter"); RETURN_FALSE; } @@ -1670,17 +1670,17 @@ PHP_FUNCTION(mb_strpos) case 1: break; case 2: - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Needle has not positive length."); + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Needle has not positive length"); break; case 4: - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown encoding or conversion error."); + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown encoding or conversion error"); break; case 8: - php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Argument is empty."); + php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Argument is empty"); break; default: - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown error in mb_strpos."); - break; + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown error in mb_strpos"); + break; } RETVAL_FALSE; } @@ -1767,10 +1767,13 @@ PHP_FUNCTION(mb_strrpos) RETURN_FALSE; } - if ((offset > 0 && offset > mbfl_strlen(&haystack)) || - (offset < 0 && -offset > mbfl_strlen(&haystack))) { - php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Offset is greater than the length of haystack string"); - RETURN_FALSE; + { + int haystack_char_len = mbfl_strlen(&haystack); + if ((offset > 0 && offset > haystack_char_len) || + (offset < 0 && -offset > haystack_char_len)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string"); + RETURN_FALSE; + } } n = mbfl_strpos(&haystack, &needle, offset, 1); @@ -1824,10 +1827,6 @@ PHP_FUNCTION(mb_strripos) RETURN_FALSE; } - if(offset > old_haystack_len){ - RETURN_FALSE; - } - n = php_mb_stripos(1, old_haystack, old_haystack_len, old_needle, old_needle_len, offset, from_encoding TSRMLS_CC); if (n >= 0) { @@ -1987,7 +1986,7 @@ PHP_FUNCTION(mb_stristr) RETURN_FALSE; } - n = php_mb_stripos(0, haystack.val, haystack.len, needle.val, needle.len, 0, from_encoding TSRMLS_CC); + n = php_mb_stripos(0, haystack.val, haystack.len, needle.val, needle.len, 0, from_encoding TSRMLS_CC); if (n <0) { RETURN_FALSE; @@ -4310,9 +4309,21 @@ MBSTRING_API int php_mb_stripos(int mode, char *old_haystack, int old_haystack_l break; } - if (offset < 0 || (unsigned long)offset > haystack.len) { - php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset not contained in string."); - break; + { + int haystack_char_len = mbfl_strlen(&haystack); + + if (mode) { + if ((offset > 0 && offset > haystack_char_len) || + (offset < 0 && -offset > haystack_char_len)) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string"); + break; + } + } else { + if (offset < 0 || offset > haystack_char_len) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset not contained in string"); + break; + } + } } n = mbfl_strpos(&haystack, &needle, offset, mode); @@ -4326,7 +4337,7 @@ MBSTRING_API int php_mb_stripos(int mode, char *old_haystack, int old_haystack_l efree(needle.val); } - return n; + return n; } /* }}} */ diff --git a/ext/mbstring/tests/bug45923.phpt b/ext/mbstring/tests/bug45923.phpt new file mode 100644 index 0000000000..2d184ab019 --- /dev/null +++ b/ext/mbstring/tests/bug45923.phpt @@ -0,0 +1,202 @@ +--TEST-- +Bug #45923 (mb_st[r]ripos() offset not handled correctly) +--SKIPIF-- + +--INI-- +mbstring.internal_encoding=UTF-8 +--FILE-- + +--EXPECTF-- +int(0) +int(4) +int(8) +bool(false) +bool(false) + +Warning: strpos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: strpos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: strpos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: strpos(): Offset not contained in string in %s on line %d +bool(false) +int(0) +int(4) +int(8) +bool(false) +bool(false) + +Warning: mb_strpos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: mb_strpos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: mb_strpos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: mb_strpos(): Offset not contained in string in %s on line %d +bool(false) +int(0) +int(4) +int(8) +bool(false) +bool(false) + +Warning: stripos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: stripos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: stripos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: stripos(): Offset not contained in string in %s on line %d +bool(false) +int(0) +int(4) +int(8) +bool(false) +bool(false) + +Warning: mb_stripos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: mb_stripos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: mb_stripos(): Offset not contained in string in %s on line %d +bool(false) + +Warning: mb_stripos(): Offset not contained in string in %s on line %d +bool(false) +int(8) +int(8) +int(8) +bool(false) +bool(false) + +Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) +int(8) +int(8) +int(4) +int(8) +int(8) +int(8) +bool(false) +bool(false) + +Warning: mb_strrpos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) +int(8) +int(8) +int(4) +int(8) +int(8) +int(8) +bool(false) +bool(false) + +Warning: strripos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) +int(8) +int(8) +int(4) +int(8) +int(8) +int(8) +bool(false) +bool(false) + +Warning: mb_strripos(): Offset is greater than the length of haystack string in %s on line %d +bool(false) +int(8) +int(8) +int(4)