Re: cvs: php-src /ext/standard var_unserializer.c var_unserializer.re

Hello Stefan, Saturday, December 4, 2004, 12:49:19 PM, you wrote: > Marcus Boerger wrote: >> Hello Stefan, >> >> reading the patch twice and checking the code again. Why not simply >> replace the index type 'iv' with 'uiv' ? >> >> "R:" iv ";" -> "R:" uiv ";" >> "r:" iv ";" -> "r:" uiv ";" > Because that would not fix anything. Both functions do not check for > integer overflows when generating the number. So any positive number > above 2^31 will be negative when casted to int. Ic, in that case iv->uiv is still a good idea and the first check shouldn't be if (id == -1 || var_access... but if (id < 0 || var_access... . And as a result of those problems we may need to verify the values generated with parse_iv() and parse_uiv(). regards marcus -- Best regards, Marcus mailto:helly@php.net