Skip to content

Commit d706dc1

Browse files
committed
Merge branch 'PHP-8.4'
* PHP-8.4: Fix OSS-Fuzz #427814456
2 parents 30662e4 + 5d590a1 commit d706dc1

File tree

2 files changed

+17
-1
lines changed

2 files changed

+17
-1
lines changed
Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
--TEST--
2+
OSS-Fuzz #427814456
3+
--FILE--
4+
<?php
5+
set_error_handler(function(){unset($GLOBALS['x']);});
6+
$x = str_repeat("3e33", random_int(2, 2));
7+
$x & true;
8+
echo "Done\n";
9+
?>
10+
--EXPECT--
11+
Done

Zend/zend_operators.c

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -402,6 +402,7 @@ static zend_never_inline zend_long ZEND_FASTCALL zendi_try_get_long(const zval *
402402
zend_long lval;
403403
double dval;
404404
bool trailing_data = false;
405+
zend_string *op_str = NULL; /* protect against error handlers */
405406

406407
/* For BC reasons we allow errors so that we can warn on leading numeric string */
407408
type = is_numeric_string_ex(Z_STRVAL_P(op), Z_STRLEN_P(op), &lval, &dval,
@@ -411,6 +412,9 @@ static zend_never_inline zend_long ZEND_FASTCALL zendi_try_get_long(const zval *
411412
return 0;
412413
}
413414
if (UNEXPECTED(trailing_data)) {
415+
if (type != IS_LONG) {
416+
op_str = zend_string_copy(Z_STR_P(op));
417+
}
414418
zend_error(E_WARNING, "A non-numeric value encountered");
415419
if (UNEXPECTED(EG(exception))) {
416420
*failed = 1;
@@ -426,11 +430,12 @@ static zend_never_inline zend_long ZEND_FASTCALL zendi_try_get_long(const zval *
426430
*/
427431
lval = zend_dval_to_lval_cap(dval);
428432
if (!zend_is_long_compatible(dval, lval)) {
429-
zend_incompatible_string_to_long_error(Z_STR_P(op));
433+
zend_incompatible_string_to_long_error(op_str ? op_str : Z_STR_P(op));
430434
if (UNEXPECTED(EG(exception))) {
431435
*failed = 1;
432436
}
433437
}
438+
zend_tmp_string_release(op_str);
434439
return lval;
435440
}
436441
}

0 commit comments

Comments
 (0)