svn: /php/php-src/branches/PHP_5_3/ NEWS ext/standard/string.c ext/standard/tests/strings/bug54454.phpt ext/standard/tests/strings/substr_compare.phpt

pierrick Thu, 21 Apr 2011 01:51:24 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=310401 Log: Revert bug #54454 fix from PHP_5_3 branch to avoid BC break in minor release Bug: http://bugs.php.net/54454 (Re-Opened) substr_compare incorrectly reports equality in some cases Changed paths: U php/php-src/branches/PHP_5_3/NEWS U php/php-src/branches/PHP_5_3/ext/standard/string.c D php/php-src/branches/PHP_5_3/ext/standard/tests/strings/bug54454.phpt U php/php-src/branches/PHP_5_3/ext/standard/tests/strings/substr_compare.phpt Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2011-04-20 18:32:07 UTC (rev 310400) +++ php/php-src/branches/PHP_5_3/NEWS 2011-04-21 01:51:24 UTC (rev 310401) @@ -18,8 +18,6 @@ . Implemented FR #54459 (Range function accuracy). (Adam) . Added PHP_MANDIR constant telling where the manpages were installed into, and an --man-dir argument to php-config. (Hannes) - . Fixed bug #54454 (substr_compare incorrectly reports equality in some - cases). (Pierrick) . Fixed bug #54238 (use-after-free in substr_replace()). (Stas) (CVE-2011-1148) . Fixed bug #54180 (parse_url() incorrectly parses path when ? in fragment). Modified: php/php-src/branches/PHP_5_3/ext/standard/string.c =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/string.c 2011-04-20 18:32:07 UTC (rev 310400) +++ php/php-src/branches/PHP_5_3/ext/standard/string.c 2011-04-21 01:51:24 UTC (rev 310401) @@ -5278,6 +5278,10 @@ RETURN_FALSE; } + if (len > s1_len - offset) { + len = s1_len - offset; + } + cmp_len = (uint) (len ? len : MAX(s2_len, (s1_len - offset))); if (!cs) { Deleted: php/php-src/branches/PHP_5_3/ext/standard/tests/strings/bug54454.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/tests/strings/bug54454.phpt 2011-04-20 18:32:07 UTC (rev 310400) +++ php/php-src/branches/PHP_5_3/ext/standard/tests/strings/bug54454.phpt 2011-04-21 01:51:24 UTC (rev 310401) @@ -1,8 +0,0 @@ ---TEST-- -Bug #54454 (substr_compare incorrectly reports equality in some cases) ---FILE-- -<?php -var_dump(substr_compare('/', '/asd', 0, 4)); -?> ---EXPECT-- -int(-3) Modified: php/php-src/branches/PHP_5_3/ext/standard/tests/strings/substr_compare.phpt =================================================================== --- php/php-src/branches/PHP_5_3/ext/standard/tests/strings/substr_compare.phpt 2011-04-20 18:32:07 UTC (rev 310400) +++ php/php-src/branches/PHP_5_3/ext/standard/tests/strings/substr_compare.phpt 2011-04-21 01:51:24 UTC (rev 310401) @@ -27,7 +27,7 @@ Warning: substr_compare(): The start position cannot exceed initial string length in %s on line %d bool(false) -int(-1) +int(0) Warning: substr_compare() expects parameter 5 to be boolean, object given in %s on line %d bool(false)