From: Zeev Suraski <zeev@php.net>
Date: Tue, 26 Jun 2001 21:11:35 +0000 (+0000)
Subject: Fixed autoconversion of negative values to double (Fix bug #11685)
X-Git-Tag: PRE_TSRM_MERGE_PATCH~328
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5e999930589ca2c45a979d45b093d5a79e6c7ea6;p=php

Fixed autoconversion of negative values to double (Fix bug #11685)
---

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 11d72f6dc4..7cf3409e42 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -611,7 +611,7 @@ ZEND_API int add_function(zval *result, zval *op1, zval *op2)
 	if (op1->type == IS_LONG && op2->type == IS_LONG) {
 		double dval = (double) op1->value.lval + (double) op2->value.lval;
 
-		if (dval > (double) LONG_MAX) {
+		if ((dval > (double) LONG_MAX) || (dval < (double) LONG_MIN)) {
 			result->value.dval = dval;
 			result->type = IS_DOUBLE;
 		} else {
@@ -648,7 +648,7 @@ ZEND_API int sub_function(zval *result, zval *op1, zval *op2)
 	if (op1->type == IS_LONG && op2->type == IS_LONG) {
 		double dval = (double) op1->value.lval - (double) op2->value.lval;
 
-		if (dval < (double) LONG_MIN) {
+		if ((dval < (double) LONG_MIN) || (dval > (double) LONG_MAX)) {
 			result->value.dval = dval;
 			result->type = IS_DOUBLE;
 		} else {
@@ -685,7 +685,7 @@ ZEND_API int mul_function(zval *result, zval *op1, zval *op2)
 	if (op1->type == IS_LONG && op2->type == IS_LONG) {
 		double dval = (double) op1->value.lval * (double) op2->value.lval;
 
-		if (dval > (double) LONG_MAX) {
+		if ((dval > (double) LONG_MAX) || (dval < (double) LONG_MIN)) {
 			result->value.dval = dval;
 			result->type = IS_DOUBLE;
 		} else {