From 7d2b089860b1eaec12e8025bfbcb7780447339e0 Mon Sep 17 00:00:00 2001
From: Felipe Pena <felipe@php.net>
Date: Fri, 10 Dec 2010 00:47:51 +0000
Subject: [PATCH] - Fixed bug #53512 (NumberFormatter::setSymbol crash on bogus
 $attr values)

---
 NEWS                                | 4 ++++
 ext/intl/formatter/formatter_attr.c | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/NEWS b/NEWS
index 05093028d7..1073939d73 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,10 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 20??, PHP 5.3.5
+- Intl extension:
+  . Fixed bug #53512 (NumberFormatter::setSymbol crash on bogus $attr values).
+    (Felipe)
+
 - PDO Oracle driver:
   . Fixed bug #39199 (Cannot load Lob data with more than 4000 bytes on
     ORACLE 10). (spatar at mail dot nnov dot ru)
diff --git a/ext/intl/formatter/formatter_attr.c b/ext/intl/formatter/formatter_attr.c
index 851b2b310e..46d61fb1fc 100755
--- a/ext/intl/formatter/formatter_attr.c
+++ b/ext/intl/formatter/formatter_attr.c
@@ -311,6 +311,11 @@ PHP_FUNCTION( numfmt_set_symbol )
 
 		RETURN_FALSE;
 	}
+	
+	if (symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0) {
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"numfmt_set_symbol: invalid symbol value", 0 TSRMLS_CC );
+		RETURN_FALSE;
+	}
 
 	/* Fetch the object. */
 	FORMATTER_METHOD_FETCH_OBJECT;
-- 
2.40.0