#21523 [Asn->Csd]: number_format causes call to emalloc for a negative amount of memory

ID: 21523 Updated by: wez@php.net Reported By: cteubner@ncw-av.com -Status: Assigned +Status: Closed Bug Type: Strings related Operating System: Windows 2000 PHP Version: 4.3.0 Assigned To: wez New Comment: This bug has been fixed in CVS. In case this was a PHP problem, snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. In case this was a documentation problem, the fix will show up soon at http://www.php.net/manual/. In case this was a PHP.net website problem, the change will show up on the PHP.net site and on the mirror sites in short time. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2003-01-09 07:20:31] wez@php.net working on a fix ------------------------------------------------------------------------ [2003-01-09 06:36:52] wez@php.net sprintf under win32 can crash when the format width is too large. Changing the emalloc + sprintf to spprintf highlights a problem in our spprintf implementation; it only returns a string of 80 chars. This length causes the reslen calculation to produce a negative number and thus emalloc to fail. ------------------------------------------------------------------------ [2003-01-09 06:20:14] busia@tiscali.it I have tried to reproduce this error on windows and linux: Windows XP professional + php 4.3.0: bug reproduced FATAL: emalloc(): Unable to allocate -207 bytes Linux Redhat 7.0 + php 4.3.0 bug NOT reproduced. the script works well. only windows systems seems to be affected by the bug ------------------------------------------------------------------------ [2003-01-09 06:15:25] nicos@php.net Verified under WIN32. ------------------------------------------------------------------------ [2003-01-09 06:05:50] nicos@php.net I can't reproduce this error under Linux, FreeBSD. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/21523 -- Edit this bug report at http://bugs.php.net/?id=21523&edit=1