Skip to content

Commit b47d6b3

Browse files
reezecataphract
authored andcommittedJul 17, 2012
Fix test fails: ext/standard/tests/general_functions/bug27678.phpt
After commit 3e62aae, number_format() returns string with length, but _php_math_number_format_ex_len() didn't set string length on nan and inf. This cause segfault when destruct the return value.
1 parent d0e58bf commit b47d6b3

File tree

2 files changed

+7
-1
lines changed

2 files changed

+7
-1
lines changed
 

‎ext/standard/math.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1120,6 +1120,10 @@ static char *_php_math_number_format_ex_len(double d, int dec, char *dec_point,
11201120
tmplen = spprintf(&tmpbuf, 0, "%.*F", dec, d);
11211121

11221122
if (tmpbuf == NULL || !isdigit((int)tmpbuf[0])) {
1123+
if (result_len) {
1124+
*result_len = tmplen;
1125+
}
1126+
11231127
return tmpbuf;
11241128
}
11251129

‎ext/standard/tests/general_functions/bug27678.phpt

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,11 @@ Bug #27678 (number_format() crashes with large numbers)
66
number_format(1e80, 0, '', ' ');
77
number_format(1e300, 0, '', ' ');
88
number_format(1e320, 0, '', ' ');
9-
number_format(1e1000, 0, '', ' ');
9+
$num = number_format(1e1000, 0, '', ' ');
10+
var_dump(strlen($num) == 3); // $num == 'inf'
1011

1112
echo "Done\n";
1213
?>
1314
--EXPECT--
15+
bool(true)
1416
Done

0 commit comments

Comments
 (0)
Please sign in to comment.