#40754 [Opn->Csd]: substr() checks overflow

ID: 40754 Updated by: iliaa@php.net Reported By: christopher dot jones at oracle dot com -Status: Open +Status: Closed Bug Type: Strings related Operating System: Enterprise Linux PHP Version: 5CVS-2007-03-08 (CVS) New Comment: This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better. The strspn() and strcspn() is expected behavior. Previous Comments: ------------------------------------------------------------------------ [2007-03-09 01:01:45] christopher dot jones at oracle dot com I've sent a patch and testcase to Tony. ------------------------------------------------------------------------ [2007-03-08 00:57:37] christopher dot jones at oracle dot com Description: ------------ Related to the problems fixes in today's patches for substr_count() and substr_compare() there are issues with substr() and substr_replace(). Also there might be return value inconsistencies with strspn() and strcspn(). Reproduce code: --------------- <?php $v = 2147483647; # INT_MAX on 32bit Linux # Tries to allocate too much memory var_dump(substr("abcde", 1, $v)); var_dump(substr_replace("abcde", "x", $v, $v)); # Functions with ill-defined behavior var_dump(strspn("abcde", "abc", $v, $v)); # should return 0 but gives false var_dump(strcspn("abcde", "abc", $v, $v)); # should return 0 but gives false # Crashes var_dump(substr_count("abcde", "abc", $v, $v)); # crashes <= 5.2.1. Fixed by Ilia http://news.php.net/php.cvs/43456 var_dump(substr_compare("abcde", "abc", $v, $v)); # crashes <= 5.2.1. Fixed by Stanislav http://news.php.net/php.cvs/43453 # Other tests (currently working) var_dump(stripos("abcde", "abc", $v)); var_dump(substr_count("abcde", "abc", $v, 1)); var_dump(substr_count("abcde", "abc", 1, $v)); var_dump(strpos("abcde", "abc", $v)); var_dump(stripos("abcde", "abc", $v)); var_dump(strrpos("abcde", "abc", $v)); var_dump(strripos("abcde", "abc", $v)); var_dump(strncmp("abcde", "abc", $v)); var_dump(chunk_split("abcde", $v, "abc")); var_dump(substr("abcde", $v, $v)); var_dump(str_repeat("a", $v+1)); ?> ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=40754&edit=1