#23225 [Opn->Csd]: money_format hangs on incorrect format

ID: 23225 Updated by: iliaa@php.net Reported By: marcot at tabini dot ca -Status: Open +Status: Closed Bug Type: Strings related Operating System: Linux RH 9 PHP Version: 5CVS-2003-04-15 (dev) New Comment: This bug has been fixed in CVS. In case this was a PHP problem, snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. In case this was a documentation problem, the fix will show up soon at http://www.php.net/manual/. In case this was a PHP.net website problem, the change will show up on the PHP.net site and on the mirror sites in short time. Thank you for the report, and for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2003-04-15 07:32:20] marcot at tabini dot ca Calling money_format with an apparently correct format <?php setlocale (LC_MONETARY, 'en_US'); echo money_format ('%#.2n', 1000); ?> causes PHP to hang (tested with 4.3.1 and 5-dev). Apparently, strfmon() returns -1 (errno is 22, indicating an invalid parameter) even though the format should theoretically be correct. The -1 is not trapped in strings.c, resulting in a huge string full of binary data being returned. Here's my suggested patch, returning false on an error from strfmon(). Index: string.c =================================================================== RCS file: /repository/php4/ext/standard/string.c,v retrieving revision 1.374 diff -u -r1.374 string.c --- string.c 13 Apr 2003 22:59:19 -0000 1.374 +++ string.c 15 Apr 2003 12:30:14 -0000 @@ -46,6 +46,7 @@ #include "php_globals.h" #include "basic_functions.h" #include "php_smart_str.h" +#include "zend_operators.h" #ifdef ZTS #include "TSRM.h" #endif @@ -4372,7 +4373,11 @@ str_len = format_len + 1024; str = emalloc(str_len); - str_len = strfmon(str, str_len, format, value); + str_len = strfmon(str, str_len, format, value); + + if (str_len == -1) + RETURN_FALSE; + str[str_len] = 0; RETURN_STRINGL(erealloc(str, str_len + 1), str_len, 0); ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=23225&edit=1