From: Derick Rethans <derick@php.net>
Date: Fri, 18 Feb 2005 13:37:23 +0000 (+0000)
Subject: - Fixed bug #32021: Crash caused by range('', 'z')
X-Git-Tag: RELEASE_0_2_4~4
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ff1687731dee44ec58113b08ac0e1004e05fad35;p=php

- Fixed bug #32021: Crash caused by range('', 'z')
---

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 270ba0dc50..9848de248d 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1590,7 +1590,7 @@ PHP_FUNCTION(range)
 	array_init(return_value);
 
 	/* If the range is given as strings, generate an array of characters. */
-	if (Z_TYPE_P(zlow) == IS_STRING && Z_TYPE_P(zhigh) == IS_STRING) {
+	if (Z_TYPE_P(zlow) == IS_STRING && Z_TYPE_P(zhigh) == IS_STRING && Z_STRLEN_P(zlow) >= 1 && Z_STRLEN_P(zhigh) >= 1) {
 		int type1, type2;
 		unsigned char *low, *high;
 		long lstep = (long) step;
diff --git a/ext/standard/tests/array/bug32021.phpt b/ext/standard/tests/array/bug32021.phpt
new file mode 100644
index 0000000000..5d3b421ab4
--- /dev/null
+++ b/ext/standard/tests/array/bug32021.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #32021 (Crash caused by range('', 'z'))
+--FILE--
+<?php
+$foo = range('', 'z');
+var_dump($foo);
+?>
+ALIVE
+--EXPECT--
+array(1) {
+  [0]=>
+  int(0)
+}
+ALIVE