Skip to content

Commit 26e8a3b

Browse files
committed
Use unsigned arithmetic in zend_atol
To avoid UB on overflow. I'm not really sure what the correct overflow behavior here would be.
1 parent 1cba776 commit 26e8a3b

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

Zend/zend_operators.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -93,12 +93,16 @@ static const unsigned char tolower_map[256] = {
9393

9494
ZEND_API zend_long ZEND_FASTCALL zend_atol(const char *str, size_t str_len) /* {{{ */
9595
{
96-
zend_long retval;
97-
9896
if (!str_len) {
9997
str_len = strlen(str);
10098
}
101-
retval = ZEND_STRTOL(str, NULL, 0);
99+
100+
/* Perform following multiplications on unsigned to avoid overflow UB.
101+
* For now overflow is silently ignored -- not clear what else can be
102+
* done here, especially as the final result of this function may be
103+
* used in an unsigned context (e.g. "memory_limit=3G", which overflows
104+
* zend_long on 32-bit, but not size_t). */
105+
zend_ulong retval = (zend_ulong) ZEND_STRTOL(str, NULL, 0);
102106
if (str_len>0) {
103107
switch (str[str_len-1]) {
104108
case 'g':
@@ -115,7 +119,7 @@ ZEND_API zend_long ZEND_FASTCALL zend_atol(const char *str, size_t str_len) /* {
115119
break;
116120
}
117121
}
118-
return retval;
122+
return (zend_long) retval;
119123
}
120124
/* }}} */
121125

0 commit comments

Comments
 (0)