From: Xinchen Hui <laruence@gmail.com>
Date: Mon, 25 Feb 2019 07:00:14 +0000 (+0800)
Subject: Fixed bug #77660 (Segmentation fault on break 2147483648)
X-Git-Tag: php-7.3.4RC1~57^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1c22ace0582fb0a2ec581237fcf1c5b9c41edd04;p=php

Fixed bug #77660 (Segmentation fault on break 2147483648)
---

diff --git a/NEWS b/NEWS
index 37138ed998..65eb3a9851 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 ?? ??? 2019, PHP 7.2.17
 
 - Core:
+  . Fixed bug #77660 (Segmentation fault on break 2147483648). (Laruence)
   . Fixed bug #77652 (Anonymous classes can lose their interface information).
     (Nikita)
 
diff --git a/Zend/tests/bug77660.phpt b/Zend/tests/bug77660.phpt
new file mode 100644
index 0000000000..94af1f9e2c
--- /dev/null
+++ b/Zend/tests/bug77660.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #77660 (Segmentation fault on break 2147483648)
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
+--FILE--
+<?php
+for(;;) break 2147483648;
+?>
+--EXPECTF--
+Fatal error: Cannot 'break' 2147483648 levels in %sbug77660.php on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 06d0015337..d0bece7228 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -4508,7 +4508,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 	zend_ast *depth_ast = ast->child[0];
 
 	zend_op *opline;
-	int depth;
+	zend_long depth;
 
 	ZEND_ASSERT(ast->kind == ZEND_AST_BREAK || ast->kind == ZEND_AST_CONTINUE);
 
@@ -4535,7 +4535,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 			ast->kind == ZEND_AST_BREAK ? "break" : "continue");
 	} else {
 		if (!zend_handle_loops_and_finally_ex(depth, NULL)) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' %d level%s",
+			zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' " ZEND_LONG_FMT " level%s",
 				ast->kind == ZEND_AST_BREAK ? "break" : "continue",
 				depth, depth == 1 ? "" : "s");
 		}