From: Matt Wilmas <mattwil@php.net>
Date: Thu, 14 May 2009 01:28:15 +0000 (+0000)
Subject: MFH: Fixed bug #45877 (Array key '2147483647' left as string)
X-Git-Tag: php-5.2.10RC1~92
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=938763c753e14751ad6c5b7d3b25c3cb237c4a8d;p=php

MFH: Fixed bug #45877 (Array key '2147483647' left as string)
---

diff --git a/NEWS b/NEWS
index 054e5bef27..87560a912f 100644
--- a/NEWS
+++ b/NEWS
@@ -83,6 +83,7 @@ PHP                                                                        NEWS
   different bit numbers). (Matt)
 - Fixed bug #45997 (safe_mode bypass with exec/system/passthru (windows only)).
   (Pierre)
+- Fixed bug #45877 (Array key '2147483647' left as string). (Matt)
 - Fixed bug #45822 (Near infinite-loops while parsing huge relative offsets).
   (Derick, Mike Sullivan)
 - Fixed bug #45799 (imagepng() crashes on empty image). (Martin McNickle,
diff --git a/Zend/tests/bug45877.phpt b/Zend/tests/bug45877.phpt
new file mode 100644
index 0000000000..2703770560
--- /dev/null
+++ b/Zend/tests/bug45877.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #45877 (Array key '2147483647' left as string)
+--INI--
+precision=20
+--FILE--
+<?php
+$keys = array(PHP_INT_MAX,
+	(string) PHP_INT_MAX,
+	(string) (-PHP_INT_MAX - 1),
+	-PHP_INT_MAX - 1,
+	(string) (PHP_INT_MAX + 1));
+
+var_dump(array_fill_keys($keys, 1));
+?>
+--EXPECTF--
+array(3) {
+  [%d7]=>
+  int(1)
+  [-%d8]=>
+  int(1)
+  ["%d8"]=>
+  int(1)
+}
diff --git a/Zend/zend.h b/Zend/zend.h
index ed9a1ec9c3..8db545afe4 100644
--- a/Zend/zend.h
+++ b/Zend/zend.h
@@ -249,6 +249,18 @@ char *alloca ();
 #define LONG_MIN (- LONG_MAX - 1)
 #endif
 
+#if SIZEOF_LONG == 4
+#define MAX_LENGTH_OF_LONG 11
+static const char long_min_digits[] = "2147483648";
+#elif SIZEOF_LONG == 8
+#define MAX_LENGTH_OF_LONG 20
+static const char long_min_digits[] = "9223372036854775808";
+#else
+#error "Unknown SIZEOF_LONG"
+#endif
+
+#define MAX_LENGTH_OF_DOUBLE 32
+
 #undef SUCCESS
 #undef FAILURE
 #define SUCCESS 0
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
index 605e23cce4..c4635e154c 100644
--- a/Zend/zend_hash.h
+++ b/Zend/zend_hash.h
@@ -298,40 +298,41 @@ END_EXTERN_C()
 	zend_hash_init(ht, n, NULL, ZVAL_PTR_DTOR, persistent)
 
 
-#define HANDLE_NUMERIC(key, length, func) {												\
-	register char *tmp=key;																\
-																						\
-	if (*tmp=='-') {																	\
-		tmp++;																			\
-	}																					\
-	if ((*tmp>='0' && *tmp<='9')) do { /* possibly a numeric index */					\
-		char *end=key+length-1;															\
-		long idx;																		\
-																						\
-		if (*tmp++=='0' && length>2) { /* don't accept numbers with leading zeros */	\
-			break;																		\
-		}																				\
-		while (tmp<end) {																\
-			if (!(*tmp>='0' && *tmp<='9')) {											\
-				break;																	\
-			}																			\
-			tmp++;																		\
-		}																				\
-		if (tmp==end && *tmp=='\0') { /* a numeric index */								\
-			if (*key=='-') {															\
-				idx = strtol(key, NULL, 10);											\
-				if (idx!=LONG_MIN) {													\
-					return func;														\
-				}																		\
-			} else {																	\
-				idx = strtol(key, NULL, 10);											\
-				if (idx!=LONG_MAX) {													\
-					return func;														\
-				}																		\
-			}																			\
-		}																				\
-	} while (0);																		\
-}
+#define HANDLE_NUMERIC(key, length, func) do {								\
+	register const char *tmp = key;											\
+																			\
+	if (*tmp == '-') {														\
+		tmp++;																\
+	}																		\
+	if (*tmp >= '0' && *tmp <= '9') { /* possibly a numeric index */		\
+		const char *end = key + length - 1;									\
+		long idx;															\
+																			\
+		if ((*end != '\0') /* not a null terminated string */				\
+		 || (*tmp == '0' && length > 2) /* numbers with leading zeros */	\
+		 || (end - tmp > MAX_LENGTH_OF_LONG - 1) /* number too long */		\
+		 || (SIZEOF_LONG == 4 &&											\
+		     end - tmp == MAX_LENGTH_OF_LONG - 1 &&							\
+		     *tmp > '2')) { /* overflow */									\
+			break;															\
+		}																	\
+		idx = (*tmp - '0');													\
+		while (++tmp != end && *tmp >= '0' && *tmp <= '9') {				\
+			idx = (idx * 10) + (*tmp - '0');								\
+		}																	\
+		if (tmp == end) {													\
+			if (*key == '-') {												\
+				idx = -idx;													\
+				if (idx > 0) { /* overflow */								\
+					break;													\
+				}															\
+			} else if (idx < 0) { /* overflow */							\
+				break;														\
+			}																\
+			return func;													\
+		}																	\
+	}																		\
+} while (0)
 
 
 static inline int zend_symtable_update(HashTable *ht, char *arKey, uint nKeyLength, void *pData, uint nDataSize, void **pDest)					\
@@ -343,7 +344,7 @@ static inline int zend_symtable_update(HashTable *ht, char *arKey, uint nKeyLeng
 
 static inline int zend_symtable_del(HashTable *ht, char *arKey, uint nKeyLength)
 {
-	HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_index_del(ht, idx))
+	HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_index_del(ht, idx));
 	return zend_hash_del(ht, arKey, nKeyLength);
 }
 
diff --git a/Zend/zend_operators.h b/Zend/zend_operators.h
index 1968cb06d5..1a2cf950c3 100644
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@ -36,18 +36,6 @@
 #include "ext/bcmath/libbcmath/src/bcmath.h"
 #endif
 
-#if SIZEOF_LONG == 4
-#define MAX_LENGTH_OF_LONG 11
-static const char long_min_digits[] = "2147483648";
-#elif SIZEOF_LONG == 8
-#define MAX_LENGTH_OF_LONG 20
-static const char long_min_digits[] = "9223372036854775808";
-#else
-#error "Unknown SIZEOF_LONG"
-#endif
-
-#define MAX_LENGTH_OF_DOUBLE 32
-
 BEGIN_EXTERN_C()
 ZEND_API int add_function(zval *result, zval *op1, zval *op2 TSRMLS_DC);
 ZEND_API int sub_function(zval *result, zval *op1, zval *op2 TSRMLS_DC);