1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
Subject: Fixed bug #53512 (NumberFormatter::setSymbol crash on bogus $attr values)
Origin: http://svn.php.net/viewvc?view=revision&revision=306154
CVE-2011-1467
Also includes http://svn.php.net/viewvc?view=revision&revision=306157
- Added test for bug #53512
Patch differs from commits in that the NEWS file addition has been
removed to reduce patch conflicts.
--- /dev/null
+++ b/ext/intl/tests/bug53512.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #53512 (NumberFormatter::setSymbol crash on bogus $attr values)
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+$badvals = array(4294901761, 2147483648, -2147483648, -1);
+
+foreach ($badvals as $val) {
+ $x = numfmt_create("en", NumberFormatter::PATTERN_DECIMAL);
+ var_dump(numfmt_set_symbol($x, $val, ""));
+ var_dump(intl_get_error_message());
+}
+
+?>
+--EXPECTF--
+bool(false)
+string(65) "numfmt_set_symbol: invalid symbol value: U_ILLEGAL_ARGUMENT_ERROR"
+bool(false)
+string(65) "numfmt_set_symbol: invalid symbol value: U_ILLEGAL_ARGUMENT_ERROR"
+bool(false)
+string(65) "numfmt_set_symbol: invalid symbol value: U_ILLEGAL_ARGUMENT_ERROR"
+bool(false)
+string(65) "numfmt_set_symbol: invalid symbol value: U_ILLEGAL_ARGUMENT_ERROR"
--- a/ext/intl/formatter/formatter_attr.c
+++ b/ext/intl/formatter/formatter_attr.c
@@ -311,6 +311,11 @@ PHP_FUNCTION( numfmt_set_symbol )
RETURN_FALSE;
}
+
+ if (symbol >= UNUM_FORMAT_SYMBOL_COUNT || symbol < 0) {
+ intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "numfmt_set_symbol: invalid symbol value", 0 TSRMLS_CC );
+ RETURN_FALSE;
+ }
/* Fetch the object. */
FORMATTER_METHOD_FETCH_OBJECT;
|
