svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/ext/intl/formatter/formatter_attr.c trunk/ext/intl/formatter/formatter_attr.c

felipe Fri, 10 Dec 2010 00:47:51 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=306154 Log: - Fixed bug #53512 (NumberFormatter::setSymbol crash on bogus $attr values) Bug: http://bugs.php.net/53512 (Open) NumberFormatter::setSymbol crash on bogus $attr values Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/intl/formatter/formatter_attr.c U php/php-src/trunk/ext/intl/formatter/formatter_attr.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2010-12-10 00:37:31 UTC (rev 306153) +++ php/php-src/branches/PHP_5_3/NEWS 2010-12-10 00:47:51 UTC (rev 306154) @@ -1,6 +1,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? 20??, PHP 5.3.5 +- Intl extension: + . Fixed bug #53512 (NumberFormatter::setSymbol crash on bogus $attr values). + (Felipe) + - PDO Oracle driver: . Fixed bug #39199 (Cannot load Lob data with more than 4000 bytes on ORACLE 10). (spatar at mail dot nnov dot ru) Modified: php/php-src/branches/PHP_5_3/ext/intl/formatter/formatter_attr.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/intl/formatter/formatter_attr.c 2010-12-10 00:37:31 UTC (rev 306153) +++ php/php-src/branches/PHP_5_3/ext/intl/formatter/formatter_attr.c 2010-12-10 00:47:51 UTC (rev 306154) @@ -311,6 +311,11 @@ RETURN_FALSE; } + + if (symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "numfmt_set_symbol: invalid symbol value", 0 TSRMLS_CC ); + RETURN_FALSE; + } /* Fetch the object. */ FORMATTER_METHOD_FETCH_OBJECT; Modified: php/php-src/trunk/ext/intl/formatter/formatter_attr.c =================================================================== --- php/php-src/trunk/ext/intl/formatter/formatter_attr.c 2010-12-10 00:37:31 UTC (rev 306153) +++ php/php-src/trunk/ext/intl/formatter/formatter_attr.c 2010-12-10 00:47:51 UTC (rev 306154) @@ -311,6 +311,11 @@ RETURN_FALSE; } + + if (symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0) { + intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "numfmt_set_symbol: invalid symbol value", 0 TSRMLS_CC ); + RETURN_FALSE; + } /* Fetch the object. */ FORMATTER_METHOD_FETCH_OBJECT;