From: Antony Dovgal <tony2001@php.net>
Date: Wed, 11 Oct 2006 13:14:08 +0000 (+0000)
Subject: avoid reading str[-1], add warning when invalid format specified
X-Git-Tag: RELEASE_1_0_0RC1~1314
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=527cc7bd3711c2b6180b79f79227143fd9b21dff;p=php

avoid reading str[-1], add warning when invalid format specified
add test
---

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 2162031eb4..5a67d861c1 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -7358,7 +7358,7 @@ static int php_u_str_word_count(UChar *str, int str_len, long type, UChar *char_
 		idx++;
 	}
 	/* last character cannot be -, unless explicitly allowed by the user */
-	if (str[str_len-1] == (UChar)0x2d /*'-'*/ &&
+	if (str_len && str[str_len-1] == (UChar)0x2d /*'-'*/ &&
 		(!char_list || !u_memchr(char_list, 0x2d /*'-'*/, char_list_len))) {
 		str_len--;
 	}
@@ -7422,7 +7422,7 @@ static int php_str_word_count(char *str, int str_len, long type, char *char_list
 		p++;
 	}
 	/* last character cannot be -, unless explicitly allowed by the user */
-	if (*(e - 1) == '-' && (!char_list || !ch['-'])) {
+	if (str_len && *(e - 1) == '-' && (!char_list || !ch['-'])) {
 		e--;
 	}
 
@@ -7477,8 +7477,17 @@ PHP_FUNCTION(str_word_count)
 		return;
 	}
 
-	if (type == 1 || type == 2) {
-		array_init(return_value);
+	switch (type) {
+		case 1:
+		case 2:
+			array_init(return_value);
+			break;
+		case 0:
+			/* nothing to be done */
+			break;
+		default:
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid format value %ld", type);
+			RETURN_FALSE;
 	}
 
 	if (str_type == IS_UNICODE) {
diff --git a/ext/standard/tests/strings/str_word_count.phpt b/ext/standard/tests/strings/str_word_count.phpt
index 20ec1e7a38..44480fc2c8 100644
--- a/ext/standard/tests/strings/str_word_count.phpt
+++ b/ext/standard/tests/strings/str_word_count.phpt
@@ -41,6 +41,8 @@ var_dump(str_word_count("'foo'", 2));
 var_dump(str_word_count("'foo'", 2, "'"));
 var_dump(str_word_count("-foo-", 2));
 var_dump(str_word_count("-foo-", 2, "-"));
+
+echo "Done\n";
 ?>
 --EXPECTF--
 array(6) {
@@ -72,10 +74,18 @@ array(6) {
   string(5) "today"
 }
 int(6)
-NULL
-NULL
-NULL
-NULL
+
+Warning: str_word_count(): Invalid format value 3 in %s on line %d
+bool(false)
+
+Warning: str_word_count(): Invalid format value 123 in %s on line %d
+bool(false)
+
+Warning: str_word_count(): Invalid format value -1 in %s on line %d
+bool(false)
+
+Warning: str_word_count(): Invalid format value 1569325056 in %s on line %d
+bool(false)
 
 Warning: str_word_count() expects parameter 2 to be long, array given in %s on line %d
 NULL
@@ -236,6 +246,7 @@ array(1) {
   [0]=>
   string(5) "-foo-"
 }
+Done
 --UEXPECTF--
 array(6) {
   [0]=>
@@ -266,10 +277,18 @@ array(6) {
   unicode(5) "today"
 }
 int(6)
-NULL
-NULL
-NULL
-NULL
+
+Warning: str_word_count(): Invalid format value 3 in %s on line %d
+bool(false)
+
+Warning: str_word_count(): Invalid format value 123 in %s on line %d
+bool(false)
+
+Warning: str_word_count(): Invalid format value -1 in %s on line %d
+bool(false)
+
+Warning: str_word_count(): Invalid format value 1569325056 in %s on line %d
+bool(false)
 
 Warning: str_word_count() expects parameter 2 to be long, array given in %s on line %d
 NULL
@@ -430,3 +449,4 @@ array(1) {
   [0]=>
   unicode(5) "-foo-"
 }
+Done
diff --git a/ext/standard/tests/strings/str_word_count1.phpt b/ext/standard/tests/strings/str_word_count1.phpt
new file mode 100644
index 0000000000..5f49fcfbf3
--- /dev/null
+++ b/ext/standard/tests/strings/str_word_count1.phpt
@@ -0,0 +1,26 @@
+--TEST--
+str_word_count() and invalid arguments
+--FILE--
+<?php
+
+var_dump(str_word_count(""));
+var_dump(str_word_count("", -1));
+var_dump(str_word_count("", -1, $a));
+var_dump($a);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+int(0)
+
+Warning: str_word_count(): Invalid format value -1 in %s on line %d
+bool(false)
+
+Notice: Undefined variable: a in %s on line %d
+
+Warning: str_word_count(): Invalid format value -1 in %s on line %d
+bool(false)
+
+Notice: Undefined variable: a in %s on line %d
+NULL
+Done