Skip to content

Commit 38e1b0d

Browse files
marc-mabemarc-mabe
committed
Fix ext/standard
1 parent a4fce72 commit 38e1b0d

File tree

9 files changed

+87
-43
lines changed

9 files changed

+87
-43
lines changed

‎ext/standard/file.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -498,10 +498,12 @@ PHP_FUNCTION(file_put_contents)
498498
if (php_stream_copy_to_stream_ex(srcstream, stream, PHP_STREAM_COPY_ALL, &len) != SUCCESS) {
499499
numbytes = -1;
500500
} else {
501+
#if SIZEOF_SIZE_T >= SIZEOF_ZEND_LONG
501502
if (len > ZEND_LONG_MAX) {
502503
php_error_docref(NULL, E_WARNING, "content truncated from %zu to " ZEND_LONG_FMT " bytes", len, ZEND_LONG_MAX);
503504
len = ZEND_LONG_MAX;
504505
}
506+
#endif
505507
numbytes = len;
506508
}
507509
break;

‎ext/standard/head.c‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ PHPAPI bool php_header(void)
7777
}
7878

7979
#define ILLEGAL_COOKIE_CHARACTER "\",\", \";\", \" \", \"\\t\", \"\\r\", \"\\n\", \"\\013\", or \"\\014\""
80-
PHPAPI zend_result php_setcookie(zend_string *name, zend_string *value, time_t expires,
80+
PHPAPI zend_result php_setcookie(zend_string *name, zend_string *value, zend_long expires,
8181
zend_string *path, zend_string *domain, bool secure, bool httponly,
8282
zend_string *samesite, bool partitioned, bool url_encode)
8383
{
@@ -110,7 +110,8 @@ PHPAPI zend_result php_setcookie(zend_string *name, zend_string *value, time_t e
110110
get_active_function_name());
111111
return FAILURE;
112112
}
113-
#ifdef ZEND_ENABLE_ZVAL_LONG64
113+
114+
#if SIZEOF_ZEND_LONG >= 8
114115
if (expires >= 253402300800) {
115116
zend_value_error("%s(): \"expires\" option cannot have a year greater than 9999",
116117
get_active_function_name());

‎ext/standard/head.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
extern PHP_RINIT_FUNCTION(head);
3030

3131
PHPAPI bool php_header(void);
32-
PHPAPI zend_result php_setcookie(zend_string *name, zend_string *value, time_t expires,
32+
PHPAPI zend_result php_setcookie(zend_string *name, zend_string *value, zend_long expires,
3333
zend_string *path, zend_string *domain, bool secure, bool httponly,
3434
zend_string *samesite, bool partitioned, bool url_encode);
3535

‎ext/standard/math.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1225,8 +1225,8 @@ PHPAPI zend_string *_php_math_number_format_long(zend_long num, zend_long dec, c
12251225
1, 10, 100, 1000, 10000,
12261226
100000, 1000000, 10000000, 100000000, 1000000000,
12271227
#if SIZEOF_ZEND_LONG == 8
1228-
10000000000, 100000000000, 1000000000000, 10000000000000, 100000000000000,
1229-
1000000000000000, 10000000000000000, 100000000000000000, 1000000000000000000, 10000000000000000000ul
1228+
Z_UL(10000000000), Z_UL(100000000000), Z_UL(1000000000000), Z_UL(10000000000000), Z_UL(100000000000000),
1229+
Z_UL(1000000000000000), Z_UL(10000000000000000), Z_UL(100000000000000000), Z_UL(1000000000000000000), Z_UL(10000000000000000000)
12301230
#elif SIZEOF_ZEND_LONG > 8
12311231
# error "Unknown SIZEOF_ZEND_LONG"
12321232
#endif
@@ -1256,7 +1256,7 @@ PHPAPI zend_string *_php_math_number_format_long(zend_long num, zend_long dec, c
12561256
// rounding the number
12571257
if (dec < 0) {
12581258
// Check rounding to more negative places than possible
1259-
if (dec < -(sizeof(powers) / sizeof(powers[0]) - 1)) {
1259+
if (dec < -(zend_long)(sizeof(powers) / sizeof(powers[0]) - 1)) {
12601260
tmpnum = 0;
12611261
} else {
12621262
power = powers[-dec];

‎ext/standard/string.c‎

Lines changed: 50 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2227,27 +2227,39 @@ static inline void _zend_substr(zval *return_value, zend_string *str, zend_long
22272227
/* if "from" position is negative, count start position from the end
22282228
* of the string
22292229
*/
2230-
if (-(size_t)f > ZSTR_LEN(str)) {
2230+
f = (zend_long)ZSTR_LEN(str) + f;
2231+
if (f < 0) {
22312232
f = 0;
2232-
} else {
2233-
f = (zend_long)ZSTR_LEN(str) + f;
22342233
}
2235-
} else if ((size_t)f > ZSTR_LEN(str)) {
2236-
RETURN_EMPTY_STRING();
2234+
} else {
2235+
#if SIZEOF_SIZE_T < SIZEOF_ZEND_LONG
2236+
if (UNEXPECTED(f > SIZE_MAX)) {
2237+
f = SIZE_MAX;
2238+
}
2239+
#endif
2240+
if ((size_t)f > ZSTR_LEN(str)) {
2241+
RETURN_EMPTY_STRING();
2242+
}
22372243
}
22382244

22392245
if (!len_is_null) {
22402246
if (l < 0) {
22412247
/* if "length" position is negative, set it to the length
22422248
* needed to stop that many chars from the end of the string
22432249
*/
2244-
if (-(size_t)l > ZSTR_LEN(str) - (size_t)f) {
2250+
l = (zend_long)ZSTR_LEN(str) - f + l;
2251+
if (l < 0) {
22452252
l = 0;
2246-
} else {
2247-
l = (zend_long)ZSTR_LEN(str) - f + l;
22482253
}
2249-
} else if ((size_t)l > ZSTR_LEN(str) - (size_t)f) {
2250-
l = (zend_long)ZSTR_LEN(str) - f;
2254+
} else {
2255+
#if SIZEOF_SIZE_T < SIZEOF_ZEND_LONG
2256+
if (UNEXPECTED(l > SIZE_MAX)) {
2257+
l = SIZE_MAX;
2258+
}
2259+
#endif
2260+
if ((size_t)l > ZSTR_LEN(str) - (size_t)f) {
2261+
l = (zend_long)ZSTR_LEN(str) - f;
2262+
}
22512263
}
22522264
} else {
22532265
l = (zend_long)ZSTR_LEN(str) - f;
@@ -2362,8 +2374,15 @@ PHP_FUNCTION(substr_replace)
23622374
if (f < 0) {
23632375
f = 0;
23642376
}
2365-
} else if ((size_t)f > ZSTR_LEN(str)) {
2366-
f = ZSTR_LEN(str);
2377+
} else {
2378+
#if SIZEOF_SIZE_T < SIZEOF_ZEND_LONG
2379+
if (UNEXPECTED(f > SIZE_MAX)) {
2380+
f = SIZE_MAX;
2381+
}
2382+
#endif
2383+
if ((size_t)f > ZSTR_LEN(str)) {
2384+
f = ZSTR_LEN(str);
2385+
}
23672386
}
23682387
/* if "length" position is negative, set it to the length
23692388
* needed to stop that many chars from the end of the string
@@ -2375,6 +2394,12 @@ PHP_FUNCTION(substr_replace)
23752394
}
23762395
}
23772396

2397+
#if SIZEOF_SIZE_T < SIZEOF_ZEND_LONG
2398+
if (UNEXPECTED(l > SIZE_MAX)) {
2399+
l = SIZE_MAX;
2400+
}
2401+
#endif
2402+
23782403
if ((size_t)l > ZSTR_LEN(str)) {
23792404
l = ZSTR_LEN(str);
23802405
}
@@ -2524,6 +2549,12 @@ PHP_FUNCTION(substr_replace)
25242549
}
25252550
}
25262551

2552+
#if SIZEOF_SIZE_T < SIZEOF_ZEND_LONG
2553+
if (UNEXPECTED(l > SIZE_MAX)) {
2554+
l = SIZE_MAX;
2555+
}
2556+
#endif
2557+
25272558
ZEND_ASSERT(0 <= f && f <= ZEND_LONG_MAX);
25282559
ZEND_ASSERT(0 <= l && l <= ZEND_LONG_MAX);
25292560
if (((size_t) f + l) > ZSTR_LEN(orig_str)) {
@@ -5798,6 +5829,13 @@ PHP_FUNCTION(str_pad)
57985829
Z_PARAM_LONG(pad_type_val)
57995830
ZEND_PARSE_PARAMETERS_END();
58005831

5832+
#if SIZEOF_SIZE_T < SIZEOF_ZEND_LONG
5833+
if (pad_length > SIZE_MAX/2) {
5834+
zend_argument_value_error(2, "must be lower or equal to %zd", SIZE_MAX/2);
5835+
RETURN_THROWS();
5836+
}
5837+
#endif
5838+
58015839
/* If resulting string turns out to be shorter than input string,
58025840
we simply copy the input and return. */
58035841
if (pad_length < 0 || (size_t)pad_length <= ZSTR_LEN(input)) {

‎ext/standard/tests/strings/gh15613.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
GH-15613 overflow on hex strings repeater value
33
--SKIPIF--
44
<?php
5-
if (PHP_INT_SIZE != 8) die("skip this test is for 64 bit platform only");
5+
if (PHP_SYS_SIZE != 8) die("skip this test is for 64 bit platform only");
66
?>
77
--INI--
88
memory_limit=-1

‎ext/standard/tests/strings/sprintf_rope_optimization_004.phpt‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,22 +7,24 @@ gmp
77

88
$a = new GMP("42");
99
$b = new GMP("-1337");
10-
$c = new GMP("999999999999999999999999999999999");
10+
$c = new GMP((string)PHP_INT_MAX);
11+
$d = new GMP((string)PHP_INT_MIN);
12+
$e = new GMP("999999999999999999999999999999999");
1113

1214
try {
1315
if (PHP_INT_SIZE == 8) {
14-
var_dump(sprintf("%d/%d/%d/%s", $a, $b, $c, $c + 1));
15-
var_dump("42/-1337/2147483647/1000000000000000000000000000000000");
16+
var_dump(sprintf("%d/%d/%d/%d/%d/%s", $a, $b, $c, $d, $e, $e + 1));
17+
var_dump("42/-1337/2147483647/-2147483648/2147483647/1000000000000000000000000000000000");
1618
} else {
17-
var_dump("42/-1337/4089650035136921599/1000000000000000000000000000000000");
18-
var_dump(sprintf("%d/%d/%d/%s", $a, $b, $c, $c + 1));
19+
var_dump("42/-1337/9223372036854775807/-9223372036854775808/4089650035136921599/1000000000000000000000000000000000");
20+
var_dump(sprintf("%d/%d/%d/%d/%d/%s", $a, $b, $c, $d, $e, $e + 1));
1921
}
2022
} catch (\Throwable $e) {echo $e, PHP_EOL; } echo PHP_EOL;
2123

2224
echo "Done";
2325
?>
2426
--EXPECTF--
25-
string(63) "42/-1337/4089650035136921599/1000000000000000000000000000000000"
26-
string(54) "42/-1337/2147483647/1000000000000000000000000000000000"
27+
string(104) "42/-1337/9223372036854775807/-9223372036854775808/4089650035136921599/1000000000000000000000000000000000"
28+
string(77) "42/-1337/2147483647/-2147483648/2147483647/1000000000000000000000000000000000"
2729

2830
Done

‎ext/standard/tests/strings/str_pad_variation1.phpt‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
--TEST--
22
Test str_pad() function : usage variations - large values for '$pad_length' argument
3+
--INI--
4+
memory_limit=1g
35
--SKIPIF--
46
<?php
57
if (getenv("USE_ZEND_ALLOC") === "0") {
@@ -12,7 +14,7 @@ if (getenv("USE_ZEND_ALLOC") === "0") {
1214
* and expected type for '$input'
1315
*/
1416

15-
echo "*** Testing str_pad() function: with large value for for 'pad_length' argument ***\n";
17+
echo "*** Testing str_pad() function: with large value for 'pad_length' argument ***\n";
1618

1719
//defining '$input' argument
1820
$input = "Test string";
@@ -24,13 +26,12 @@ try {
2426
echo $e->getMessage() . "\n";
2527
}
2628

27-
$php_int_max_pad_length = PHP_INT_MAX;
28-
var_dump( str_pad($input, $php_int_max_pad_length) );
29-
29+
// INT32_MAX
30+
var_dump( str_pad($input, 2147483647) );
3031

3132
?>
3233
--EXPECTF--
33-
*** Testing str_pad() function: with large value for for 'pad_length' argument ***
34+
*** Testing str_pad() function: with large value for 'pad_length' argument ***
3435
str_pad(): Argument #2 ($length) must be of type int, float given
3536

3637
Fatal error: Allowed memory size of %d bytes exhausted%s(tried to allocate %d bytes) in %s on line %d

‎ext/standard/tests/strings/str_pad_variation5.phpt‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,26 +4,26 @@ Test str_pad() function : usage variations - unexpected large value for '$pad_le
44
memory_limit=128M
55
--SKIPIF--
66
<?php
7-
if (PHP_INT_SIZE != 4) die("skip this test is for 32bit platform only");
7+
if (PHP_SYS_SIZE >= PHP_INT_SIZE) {
8+
die("skip this test is for PHP_SyS_SIZE < PHP_INT_SIZE only");
9+
}
810
if (getenv("USE_ZEND_ALLOC") === "0") {
911
die("skip Zend MM disabled");
1012
}
11-
?>
13+
1214
--FILE--
1315
<?php
14-
/* Test str_pad() function: with unexpected inputs for '$pad_length'
15-
* and expected type for '$input'
16-
*/
16+
$input = "Test string";
1717

18-
echo "*** Testing str_pad() function: with large value for for 'pad_length' argument ***\n";
18+
try {
19+
var_dump( str_pad($input, PHP_INT_MAX) );
20+
} catch (ValueError $e) {
21+
echo $e::class . ": {$e->getMessage()}\n";
22+
}
1923

20-
//defining '$input' argument
21-
$input = "Test string";
22-
$pad_length = PHP_INT_MAX - 16; /* zend_string header is 16 bytes */
23-
var_dump( str_pad($input, $pad_length) );
24+
var_dump( str_pad($input, 2**(PHP_SYS_SIZE*8-1)-1) );
2425

25-
?>
2626
--EXPECTF--
27-
*** Testing str_pad() function: with large value for for 'pad_length' argument ***
27+
ValueError: str_pad(): Argument #2 ($length) must be lower or equal to %d
2828

2929
Fatal error: Allowed memory size of %d bytes exhausted%s(tried to allocate %d bytes) in %s on line %d

0 commit comments

Comments
 (0)