Skip to content

Commit e80d953

Browse files
devnexendevnexen
committed
Merge branch 'PHP-8.4'
2 parents 4152ca5 + 2e20771 commit e80d953

File tree

2 files changed

+46
-6
lines changed

2 files changed

+46
-6
lines changed

‎ext/standard/array.c

+6-6
Original file line numberDiff line numberDiff line change
@@ -3356,7 +3356,7 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
33563356

33573357
/* If hash for removed entries exists, go until offset+length and copy the entries to it */
33583358
if (removed != NULL) {
3359-
for ( ; pos < offset + length && idx < in_hash->nNumUsed; idx++, entry++) {
3359+
for ( ; pos - offset < length && idx < in_hash->nNumUsed; idx++, entry++) {
33603360
if (Z_TYPE_P(entry) == IS_UNDEF) continue;
33613361
pos++;
33623362
Z_TRY_ADDREF_P(entry);
@@ -3369,9 +3369,9 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
33693369
}
33703370
}
33713371
} else { /* otherwise just skip those entries */
3372-
int pos2 = pos;
3372+
zend_long pos2 = pos;
33733373

3374-
for ( ; pos2 < offset + length && idx < in_hash->nNumUsed; idx++, entry++) {
3374+
for ( ; pos2 - offset < length && idx < in_hash->nNumUsed; idx++, entry++) {
33753375
if (Z_TYPE_P(entry) == IS_UNDEF) continue;
33763376
pos2++;
33773377
zend_hash_packed_del_val(in_hash, entry);
@@ -3430,7 +3430,7 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
34303430

34313431
/* If hash for removed entries exists, go until offset+length and copy the entries to it */
34323432
if (removed != NULL) {
3433-
for ( ; pos < offset + length && idx < in_hash->nNumUsed; idx++, p++) {
3433+
for ( ; pos - offset < length && idx < in_hash->nNumUsed; idx++, p++) {
34343434
if (Z_TYPE(p->val) == IS_UNDEF) continue;
34353435
pos++;
34363436
entry = &p->val;
@@ -3443,9 +3443,9 @@ static void php_splice(HashTable *in_hash, zend_long offset, zend_long length, H
34433443
zend_hash_del_bucket(in_hash, p);
34443444
}
34453445
} else { /* otherwise just skip those entries */
3446-
int pos2 = pos;
3446+
zend_long pos2 = pos;
34473447

3448-
for ( ; pos2 < offset + length && idx < in_hash->nNumUsed; idx++, p++) {
3448+
for ( ; pos2 - offset < length && idx < in_hash->nNumUsed; idx++, p++) {
34493449
if (Z_TYPE(p->val) == IS_UNDEF) continue;
34503450
pos2++;
34513451
zend_hash_del_bucket(in_hash, p);

‎ext/standard/tests/array/gh18480.phpt

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
--TEST--
2+
GH-18480 (array_splice overflow with large offset / length values)
3+
--FILE--
4+
<?php
5+
6+
foreach ([PHP_INT_MIN, PHP_INT_MAX] as $length) {
7+
$a = [PHP_INT_MAX];
8+
$offset = PHP_INT_MAX;
9+
var_dump(array_splice($a,$offset, $length));
10+
$a = [PHP_INT_MAX];
11+
$offset = PHP_INT_MIN;
12+
var_dump(array_splice($a,$offset, $length));
13+
$a = ["a" => PHP_INT_MAX];
14+
$offset = PHP_INT_MAX;
15+
var_dump(array_splice($a,$offset, $length));
16+
$a = ["a" => PHP_INT_MAX];
17+
$offset = PHP_INT_MIN;
18+
var_dump(array_splice($a,$offset, $length));
19+
}
20+
--EXPECTF--
21+
array(0) {
22+
}
23+
array(0) {
24+
}
25+
array(0) {
26+
}
27+
array(0) {
28+
}
29+
array(0) {
30+
}
31+
array(1) {
32+
[0]=>
33+
int(%d)
34+
}
35+
array(0) {
36+
}
37+
array(1) {
38+
["a"]=>
39+
int(%d)
40+
}

0 commit comments

Comments
 (0)