clones/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-09-22 18:37:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.4'

Browse Source 
* PHP-7.4:
  Fix shift ub in mbstring
  Restore digit check in mb_decode_numericentity()
This commit is contained in:
Nikita Popov 2020-01-30 10:08:21 +01:00
commit 7d170eb295
4 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ext/mbstring/libmbfl/filters/mbfilter_ucs4.c
View File

@ -139,7 +139,7 @@ int mbfl_filt_conv_ucs4_wchar(int c, mbfl_convert_filter *filter)
if (endian) {
n = c & 0xff;
} else {
n = (c & 0xff) << 24;
n = (c & 0xffu) << 24;
}
filter->cache = n;
filter->status++;
@ -164,7 +164,7 @@ int mbfl_filt_conv_ucs4_wchar(int c, mbfl_convert_filter *filter)
break;
default:
if (endian) {
n = (c & 0xff) << 24;
n = (c & 0xffu) << 24;
} else {
n = c & 0xff;
}
@ -195,7 +195,7 @@ int mbfl_filt_conv_ucs4be_wchar(int c, mbfl_convert_filter *filter)
if (filter->status == 0) {
filter->status = 1;
n = (c & 0xff) << 24;
n = (c & 0xffu) << 24;
filter->cache = n;
} else if (filter->status == 1) {
filter->status = 2;
@ -251,7 +251,7 @@ int mbfl_filt_conv_ucs4le_wchar(int c, mbfl_convert_filter *filter)
filter->cache |= n;
} else {
filter->status = 0;
n = ((c & 0xff) << 24) | filter->cache;
n = ((c & 0xffu) << 24) | filter->cache;
CK((*filter->output_function)(n, filter->data));
}
return c;

8
ext/mbstring/libmbfl/filters/mbfilter_utf32.c
View File

@ -138,7 +138,7 @@ int mbfl_filt_conv_utf32_wchar(int c, mbfl_convert_filter *filter)
if (endian) {
n = c & 0xff;
} else {
n = (unsigned) (c & 0xff) << 24;
n = (c & 0xffu) << 24;
}
filter->cache = n;
filter->status++;
@ -163,7 +163,7 @@ int mbfl_filt_conv_utf32_wchar(int c, mbfl_convert_filter *filter)
break;
default:
if (endian) {
n = (c & 0xff) << 24;
n = (c & 0xffu) << 24;
} else {
n = c & 0xff;
}
@ -199,7 +199,7 @@ int mbfl_filt_conv_utf32be_wchar(int c, mbfl_convert_filter *filter)
if (filter->status == 0) {
filter->status = 1;
n = (c & 0xff) << 24;
n = (c & 0xffu) << 24;
filter->cache = n;
} else if (filter->status == 1) {
filter->status = 2;
@ -260,7 +260,7 @@ int mbfl_filt_conv_utf32le_wchar(int c, mbfl_convert_filter *filter)
filter->cache |= n;
} else {
filter->status = 0;
n = ((c & 0xff) << 24) | filter->cache;
n = ((c & 0xffu) << 24) | filter->cache;
if (n < MBFL_WCSPLANE_UTF32MAX && (n < 0xd800 || n > 0xdfff)) {
CK((*filter->output_function)(n, filter->data));
} else {

2
ext/mbstring/libmbfl/mbfl/mbfilter.c
View File

@ -2476,7 +2476,7 @@ collector_decode_htmlnumericentity(int c, void *data)
f = 0;
if (c >= 0x30 && c <= 0x39) { /* '0' - '9' */
s = pc->cache;
if (s > INT_MAX/10) {
if (pc->digit > 9 || s > INT_MAX/10) {
pc->status = 0;
f = 1;
} else {

2
ext/mbstring/tests/mb_decode_numericentity.phpt
View File

@ -19,6 +19,7 @@ echo mb_decode_numericentity('&#1000000000', $convmap), "\n";
echo mb_decode_numericentity('&#9000000000', $convmap), "\n";
echo mb_decode_numericentity('&#10000000000', $convmap), "\n";
echo mb_decode_numericentity('&#100000000000', $convmap), "\n";
echo mb_decode_numericentity('&#000000000000', $convmap), "\n";
$convmap = [];
echo mb_decode_numericentity('f&ouml;o', $convmap, "UTF-8")."\n";
@ -39,5 +40,6 @@ aŒbœcŠdše€fg
&#9000000000
&#10000000000
&#100000000000
&#000000000000
f&ouml;o
count($convmap) must be a multiple of 4