From 4676d78ab53206aa8732a8cedac9d30f350c7e28 Mon Sep 17 00:00:00 2001
From: Antony Dovgal <tony2001@php.net>
Date: Mon, 19 Feb 2007 19:44:44 +0000
Subject: [PATCH] MFB: #40503 (json_encode() value corruption on 32bit systems
 with overflown values)

---
 ext/json/json.c              | 16 ++++++++--------
 ext/json/tests/bug40503.phpt | 19 +++++++++++++++++++
 2 files changed, 27 insertions(+), 8 deletions(-)
 create mode 100644 ext/json/tests/bug40503.phpt

diff --git a/ext/json/json.c b/ext/json/json.c
index 3fa8302a18b..c262511215b 100644
--- a/ext/json/json.c
+++ b/ext/json/json.c
@@ -362,17 +362,17 @@ static void json_encode_r(smart_str *buf, zval *val TSRMLS_DC) /* {{{ */
                 int len;
                 double dbl = Z_DVAL_P(val);
 
-                if (!zend_isinf(dbl) && !zend_isnan(dbl))
-                {
+                if (!zend_isinf(dbl) && !zend_isnan(dbl)) {
                     len = spprintf(&d, 0, "%.9g", dbl);
-                    if (d)
-                    {
-                        smart_str_appendl(buf, d, len);
+                    if (d) {
+                        if (dbl > LONG_MAX && !memchr(d, '.', len)) {
+                            smart_str_append_unsigned(buf, (unsigned long)Z_DVAL_P(val));
+                        } else {
+                            smart_str_appendl(buf, d, len);
+                        }
                         efree(d);
                     }
-                }
-                else
-                {
+                } else {
                     zend_error(E_WARNING, "[json] (json_encode_r) double %.9g does not conform to the JSON spec, encoded as 0.", dbl);
                     smart_str_appendc(buf, '0');
                 }
diff --git a/ext/json/tests/bug40503.phpt b/ext/json/tests/bug40503.phpt
new file mode 100644
index 00000000000..d451eea35d0
--- /dev/null
+++ b/ext/json/tests/bug40503.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Bug #40503 (json_encode() value corruption on 32bit systems with overflown values)
+--SKIPIF--
+<?php if (!extension_loaded("json")) print "skip"; ?>
+--FILE--
+<?php
+function show_eq($x,$y) {
+	echo "$x ". ($x==$y ? "==" : "!=") ." $y\n";
+}
+
+$value = 0x7FFFFFFF; #2147483647;
+show_eq("$value", json_encode($value));
+$value++;
+show_eq("$value", json_encode($value));
+
+?>
+--EXPECT--
+2147483647 == 2147483647
+2147483648 == 2147483648