Skip to content

Fix test fails: ext/standard/tests/general_functions/bug27678.phpt - #134

Closed
reeze wants to merge 1 commit into
php:masterfrom
reeze:fix-crash-number_format
Closed

reeze wants to merge 1 commit into
php:masterfrom
reeze:fix-crash-number_format

Conversation

@reeze

@reeze reeze commented Jul 17, 2012

Copy link
Copy Markdown
Contributor

Hi,
After commit 3e62aae, number_format() set return string by length,
but _php_math_number_format_ex_len() didn't set the string length
on nan or inf.
3e62aae#L1R1258
when function _php_math_number_format_ex_len() return without set the length.
the return value's string length is wild bits. This may cause segfault when destruct the return value.

@cataphract will you take a look?

Thanks :)

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x000000015b278d8a
0x00000001004eef51 in _zval_dtor_func (zvalue=0x100cd2ea8, __zend_filename=0x1009ad298 "Zend//zend_execute.h", __zend_lineno=87)
    at zend_variables.c:35
35              CHECK_ZVAL_STRING_REL(zvalue);
(gdb) bt
#0  0x00000001004eef51 in _zval_dtor_func (zvalue=0x100cd2ea8, __zend_filename=0x1009ad298 "Zend//zend_execute.h", 
    __zend_lineno=87) at zend_variables.c:35

After commit 3e62aae, number_format() returns string with length,
but _php_math_number_format_ex_len() didn't set string length
on nan and inf. This cause segfault when destruct the return value.
@php-pulls

Copy link
Copy Markdown

Comment on behalf of cataphract at php.net:

merged. Thanks.

@php-pulls

Copy link
Copy Markdown

Comment on behalf of cataphract at php.net:

.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants