Skip to content

ext/intl: Fix NumberFormatter symbol range check on truncated values #25425

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jorgsowa wants to merge 2 commits into from
Closed

ext/intl: Fix NumberFormatter symbol range check on truncated values #25425

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bbd7728
Fix NumberFormatter symbol range check on truncated values
jorgsowa Nov 12, 2026
3aa6775
Fix NumberFormatter attribute range check on truncated values
jorgsowa Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,11 @@ PHP NEWS
. Fixed stack overflow in filter_var() and filter_var_array() with deeply
nested arrays. (Eyüp Can Akman)

- Intl:
. Fixed NumberFormatter::getSymbol(), setSymbol(), getAttribute() and
setAttribute() accepting out-of-range values that truncate to a valid one.
(Jorg Sowa)

- MBString:
. Fixed stack overflow in mb_check_encoding() and mb_convert_encoding() with
deeply nested arrays. (Eyüp Can Akman)
Expand Down
16 changes: 8 additions & 8 deletions ext/intl/formatter/formatter_attr.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ U_CFUNC PHP_FUNCTION( numfmt_get_attribute )
/* Fetch the object. */
FORMATTER_METHOD_FETCH_OBJECT;

switch(attribute) {
switch(lattribute) {
case UNUM_PARSE_INT_ONLY:
case UNUM_GROUPING_USED:
case UNUM_DECIMAL_ALWAYS_SHOWN:
Expand Down Expand Up @@ -149,7 +149,7 @@ U_CFUNC PHP_FUNCTION( numfmt_set_attribute )

UNumberFormatAttribute attribute = static_cast<UNumberFormatAttribute>(lattribute);

switch(attribute) {
switch(lattribute) {
case UNUM_PARSE_INT_ONLY:
case UNUM_GROUPING_USED:
case UNUM_DECIMAL_ALWAYS_SHOWN:
Expand Down Expand Up @@ -232,13 +232,13 @@ U_CFUNC PHP_FUNCTION( numfmt_get_symbol )
RETURN_THROWS();
}

UNumberFormatSymbol symbol = static_cast<UNumberFormatSymbol>(lsymbol);

if (UNEXPECTED(symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0)) {
if (UNEXPECTED(lsymbol < 0 || lsymbol >= UNUM_FORMAT_SYMBOL_COUNT)) {
intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "invalid symbol value");
RETURN_FALSE;
}

UNumberFormatSymbol symbol = static_cast<UNumberFormatSymbol>(lsymbol);

/* Fetch the object. */
FORMATTER_METHOD_FETCH_OBJECT;

Expand Down Expand Up @@ -274,13 +274,13 @@ U_CFUNC PHP_FUNCTION( numfmt_set_symbol )
RETURN_THROWS();
}

UNumberFormatSymbol symbol = static_cast<UNumberFormatSymbol>(lsymbol);

if (UNEXPECTED(symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0)) {
if (UNEXPECTED(lsymbol < 0 || lsymbol >= UNUM_FORMAT_SYMBOL_COUNT)) {
intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "invalid symbol value");
RETURN_FALSE;
}

UNumberFormatSymbol symbol = static_cast<UNumberFormatSymbol>(lsymbol);

@devnexen devnexen Nov 12, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think you can apply the same logic in numfmt_get_attribute and numfmt_set_attribute too.

@jorgsowa jorgsowa Nov 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Applied the fix. There are few missing value checks in this file as well, but it's not PHP 8.6 regression so I would just make in separate PR.


/* Fetch the object. */
FORMATTER_METHOD_FETCH_OBJECT;

Expand Down
6 changes: 5 additions & 1 deletion ext/intl/tests/bug53512.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ intl
--FILE--
<?php

$badvals = array(4294901761, 2147483648, -2147483648, -1);
$badvals = array(4294901761, 2147483648, -2147483648, -1, 4294967296, 4294967297);

foreach ($badvals as $val) {
$x = numfmt_create("en", NumberFormatter::PATTERN_DECIMAL);
Expand All @@ -26,3 +26,7 @@ bool(false)
string(67) "numfmt_set_symbol(): invalid symbol value: U_ILLEGAL_ARGUMENT_ERROR"
bool(false)
string(67) "numfmt_set_symbol(): invalid symbol value: U_ILLEGAL_ARGUMENT_ERROR"
bool(false)
string(67) "numfmt_set_symbol(): invalid symbol value: U_ILLEGAL_ARGUMENT_ERROR"
bool(false)
string(67) "numfmt_set_symbol(): invalid symbol value: U_ILLEGAL_ARGUMENT_ERROR"
42 changes: 42 additions & 0 deletions ext/intl/tests/formatter_get_set_attribute_truncation.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
--TEST--
NumberFormatter::getAttribute()/setAttribute() reject attributes that truncate to a valid one
--EXTENSIONS--
intl
--SKIPIF--
<?php if (PHP_INT_SIZE != 8) die('skip 64-bit only'); ?>
--FILE--
<?php

$fmt = new NumberFormatter("en", NumberFormatter::DECIMAL);

foreach ([NumberFormatter::MAX_FRACTION_DIGITS, NumberFormatter::ROUNDING_INCREMENT] as $attr) {
$bad = $attr + (1 << 32);

var_dump($fmt->getAttribute($bad));
var_dump($fmt->getErrorMessage());
var_dump(numfmt_get_attribute($fmt, $bad));

var_dump($fmt->setAttribute($bad, 5));
var_dump($fmt->getErrorMessage());
var_dump(numfmt_set_attribute($fmt, $bad, 5));
}

var_dump($fmt->getAttribute(NumberFormatter::MAX_FRACTION_DIGITS));
var_dump($fmt->getAttribute(NumberFormatter::ROUNDING_INCREMENT));

?>
--EXPECT--
bool(false)
string(83) "NumberFormatter::getAttribute(): Error getting attribute value: U_UNSUPPORTED_ERROR"
bool(false)
bool(false)
string(83) "NumberFormatter::setAttribute(): Error setting attribute value: U_UNSUPPORTED_ERROR"
bool(false)
bool(false)
string(83) "NumberFormatter::getAttribute(): Error getting attribute value: U_UNSUPPORTED_ERROR"
bool(false)
bool(false)
string(83) "NumberFormatter::setAttribute(): Error setting attribute value: U_UNSUPPORTED_ERROR"
bool(false)
int(3)
float(0)
4 changes: 2 additions & 2 deletions ext/intl/tests/formatter_get_set_symbol2.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,9 @@ function ut_main()
// Restore attribute's symbol.
ut_nfmt_set_symbol( $fmt, $symb, $orig_val );
}
$badvals = array(2147483648, -2147483648, -1, 4294901761);
$badvals = array(2147483648, -2147483648, -1, 4294901761, 4294967296, 4294967297);
foreach($badvals as $badval) {
if(ut_nfmt_get_symbol( $fmt, 2147483648 )) {
if(ut_nfmt_get_symbol( $fmt, $badval )) {
$res_str .= "Bad value $badval should return false!\n";
}
}
Expand Down
Loading