com php-src: Fixed bug #74484 MessageFormatter::formatMessage memory corruption: ext/intl/msgformat/msgformat_helpers.cpp ext/
intl/tests/bug74484_MessageFormatter.phpt

Commit: 45a05f38410d4a67c8c83c09906e2cfb42fc6e4c Author: Anatol Belski <ab@php.net> Thu, 9 Aug 2018 22:07:24 +0200 Parents: 935625f1b88c69ceecb2c391fd18a14b1be4b4f7 Branches: PHP-7.1 PHP-7.2 PHP-7.3 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=45a05f38410d4a67c8c83c09906e2cfb42fc6e4c Log: Fixed bug #74484 MessageFormatter::formatMessage memory corruption with 11+ named placeholder Bugs: https://bugs.php.net/74484 Changed paths: M ext/intl/msgformat/msgformat_helpers.cpp A ext/intl/tests/bug74484_MessageFormatter.phpt Diff: diff --git a/ext/intl/msgformat/msgformat_helpers.cpp b/ext/intl/msgformat/msgformat_helpers.cpp index ce7899e..29956c7 100644 --- a/ext/intl/msgformat/msgformat_helpers.cpp +++ b/ext/intl/msgformat/msgformat_helpers.cpp @@ -27,6 +27,7 @@ #include <unicode/timezone.h> #include <unicode/datefmt.h> #include <unicode/calendar.h> +#include <unicode/strenum.h> #include <vector> @@ -333,6 +334,24 @@ static void umsg_set_timezone(MessageFormatter_object *mfo, return; /* already done */ } + /* There is a bug in ICU which prevents MessageFormatter::getFormats() + to handle more than 10 formats correctly. The enumerator could be + used to walk through the present formatters using getFormat(), which + however seems to provide just a readonly access. This workaround + prevents crash when there are > 10 formats but doesn't set any error. + As a result, only DateFormatters with > 10 subformats are affected. + This workaround should be ifdef'd out, when the bug has been fixed + in ICU. */ + icu::StringEnumeration* fnames = mf->getFormatNames(err.code); + if (!fnames || U_FAILURE(err.code)) { + return; + } + count = fnames->count(err.code); + delete fnames; + if (count > 10) { + return; + } + formats = mf->getFormats(count); if (formats == NULL) { diff --git a/ext/intl/tests/bug74484_MessageFormatter.phpt b/ext/intl/tests/bug74484_MessageFormatter.phpt new file mode 100644 index 0000000..b48de33 --- /dev/null +++ b/ext/intl/tests/bug74484_MessageFormatter.phpt @@ -0,0 +1,33 @@ +--TEST-- +Bug #74484 MessageFormatter::formatMessage memory corruption with 11+ named placeholder +--SKIPIF-- +<?php +if (!extension_loaded('intl')) + die('skip intl extension not enabled'); +?> +--FILE-- +<?php +$text = "{a} {b} {c} {d} {e} {f} {g} {h} {i} {j} {k} {l}"; + +$vars = array( + 'a' => 1, + 'b' => 2, + 'c' => 3, + 'd' => 4, + 'e' => 5, + 'f' => 6, + 'g' => 7, + 'h' => 8, + 'i' => 9, + 'j' => 10, + 'k' => 11, + 'l' => 12 +); + +var_dump(MessageFormatter::formatMessage('en_US', $text, $vars)); + +?> +==DONE== +--EXPECT-- +string(26) "1 2 3 4 5 6 7 8 9 10 11 12" +==DONE==