From: Matt Wilmas <mattwil@php.net>
Date: Thu, 29 May 2008 11:45:28 +0000 (+0000)
Subject: MFH: Fixed overflow crash (at least on Windows) in div_function with LONG_MIN / -1
X-Git-Tag: php-5.2.7RC1~250
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=76a95184ef52d1d147a6b75ef2bb96e496db25bb;p=php

MFH: Fixed overflow crash (at least on Windows) in div_function with LONG_MIN / -1
---

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 6913106128..a2eeef6a2e 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -891,6 +891,11 @@ ZEND_API int div_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 		return FAILURE;			/* division by zero */
 	}
 	if (op1->type == IS_LONG && op2->type == IS_LONG) {
+		if (Z_LVAL_P(op2) == -1 && Z_LVAL_P(op1) == LONG_MIN) {
+			/* Prevent overflow error/crash */
+			ZVAL_DOUBLE(result, (double) LONG_MIN / -1);
+			return SUCCESS;
+		}
 		if (op1->value.lval % op2->value.lval == 0) { /* integer */
 			result->type = IS_LONG;
 			result->value.lval = op1->value.lval / op2->value.lval;