diff --git a/NEWS b/NEWS index 191b829f6f9c..baeb2f0b997f 100644 --- a/NEWS +++ b/NEWS @@ -60,6 +60,11 @@ PHP NEWS . Fixed stack overflow in filter_var() and filter_var_array() with deeply nested arrays. (Eyüp Can Akman) +- Intl: + . Fixed NumberFormatter::getSymbol(), setSymbol(), getAttribute() and + setAttribute() accepting out-of-range values that truncate to a valid one. + (Jorg Sowa) + - MBString: . Fixed stack overflow in mb_check_encoding() and mb_convert_encoding() with deeply nested arrays. (Eyüp Can Akman) diff --git a/ext/intl/formatter/formatter_attr.cpp b/ext/intl/formatter/formatter_attr.cpp index ff215fdffbd7..815b8abcb97d 100644 --- a/ext/intl/formatter/formatter_attr.cpp +++ b/ext/intl/formatter/formatter_attr.cpp @@ -45,7 +45,7 @@ U_CFUNC PHP_FUNCTION( numfmt_get_attribute ) /* Fetch the object. */ FORMATTER_METHOD_FETCH_OBJECT; - switch(attribute) { + switch(lattribute) { case UNUM_PARSE_INT_ONLY: case UNUM_GROUPING_USED: case UNUM_DECIMAL_ALWAYS_SHOWN: @@ -149,7 +149,7 @@ U_CFUNC PHP_FUNCTION( numfmt_set_attribute ) UNumberFormatAttribute attribute = static_cast(lattribute); - switch(attribute) { + switch(lattribute) { case UNUM_PARSE_INT_ONLY: case UNUM_GROUPING_USED: case UNUM_DECIMAL_ALWAYS_SHOWN: @@ -232,13 +232,13 @@ U_CFUNC PHP_FUNCTION( numfmt_get_symbol ) RETURN_THROWS(); } - UNumberFormatSymbol symbol = static_cast(lsymbol); - - if (UNEXPECTED(symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0)) { + if (UNEXPECTED(lsymbol < 0 || lsymbol >= UNUM_FORMAT_SYMBOL_COUNT)) { intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "invalid symbol value"); RETURN_FALSE; } + UNumberFormatSymbol symbol = static_cast(lsymbol); + /* Fetch the object. */ FORMATTER_METHOD_FETCH_OBJECT; @@ -274,13 +274,13 @@ U_CFUNC PHP_FUNCTION( numfmt_set_symbol ) RETURN_THROWS(); } - UNumberFormatSymbol symbol = static_cast(lsymbol); - - if (UNEXPECTED(symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0)) { + if (UNEXPECTED(lsymbol < 0 || lsymbol >= UNUM_FORMAT_SYMBOL_COUNT)) { intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "invalid symbol value"); RETURN_FALSE; } + UNumberFormatSymbol symbol = static_cast(lsymbol); + /* Fetch the object. */ FORMATTER_METHOD_FETCH_OBJECT; diff --git a/ext/intl/tests/bug53512.phpt b/ext/intl/tests/bug53512.phpt index 9c6a128c3000..7e8a5c626bfb 100644 --- a/ext/intl/tests/bug53512.phpt +++ b/ext/intl/tests/bug53512.phpt @@ -8,7 +8,7 @@ intl --FILE-- +--FILE-- +getAttribute($bad)); + var_dump($fmt->getErrorMessage()); + var_dump(numfmt_get_attribute($fmt, $bad)); + + var_dump($fmt->setAttribute($bad, 5)); + var_dump($fmt->getErrorMessage()); + var_dump(numfmt_set_attribute($fmt, $bad, 5)); +} + +var_dump($fmt->getAttribute(NumberFormatter::MAX_FRACTION_DIGITS)); +var_dump($fmt->getAttribute(NumberFormatter::ROUNDING_INCREMENT)); + +?> +--EXPECT-- +bool(false) +string(83) "NumberFormatter::getAttribute(): Error getting attribute value: U_UNSUPPORTED_ERROR" +bool(false) +bool(false) +string(83) "NumberFormatter::setAttribute(): Error setting attribute value: U_UNSUPPORTED_ERROR" +bool(false) +bool(false) +string(83) "NumberFormatter::getAttribute(): Error getting attribute value: U_UNSUPPORTED_ERROR" +bool(false) +bool(false) +string(83) "NumberFormatter::setAttribute(): Error setting attribute value: U_UNSUPPORTED_ERROR" +bool(false) +int(3) +float(0) diff --git a/ext/intl/tests/formatter_get_set_symbol2.phpt b/ext/intl/tests/formatter_get_set_symbol2.phpt index f6594d6a0b94..1cae6a204e53 100644 --- a/ext/intl/tests/formatter_get_set_symbol2.phpt +++ b/ext/intl/tests/formatter_get_set_symbol2.phpt @@ -75,9 +75,9 @@ function ut_main() // Restore attribute's symbol. ut_nfmt_set_symbol( $fmt, $symb, $orig_val ); } - $badvals = array(2147483648, -2147483648, -1, 4294901761); + $badvals = array(2147483648, -2147483648, -1, 4294901761, 4294967296, 4294967297); foreach($badvals as $badval) { - if(ut_nfmt_get_symbol( $fmt, 2147483648 )) { + if(ut_nfmt_get_symbol( $fmt, $badval )) { $res_str .= "Bad value $badval should return false!\n"; } }