Fix #79212: NumberFormatter::format() may detect wrong type

We have to convert to number *before* detecting the type, to cater to
internal objects implementing `cast_object`.

We also get rid of the fallback behavior of using `FORMAT_TYPE_INT32`,
because that can no longer happen; after `convert_scalar_to_number_ex`
the type is either `IS_LONG` or `IS_DOUBLE`.  We cater explicitly to
the `IS_ARRAY` case what also avoids triggering a type confusion when
`::TYPE_INT64` is passed as `$type`.

Author: cmb69

NEWS

@@ -14,6 +14,9 @@ PHP                                                                        NEWS
   . Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()).
     (cmb)
 
+ -Intl:
+  . Fixed bug #79212 (NumberFormatter::format() may detect wrong type). (cmb)
+
 - MBString:
   . Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). (cmb)
 

ext/intl/formatter/formatter_format.c

@@ -53,23 +53,23 @@ PHP_FUNCTION( numfmt_format )
 	/* Fetch the object. */
 	FORMATTER_METHOD_FETCH_OBJECT;
 
-	if(type == FORMAT_TYPE_DEFAULT) {
-		if(Z_TYPE_P(number) == IS_STRING) {
-			convert_scalar_to_number_ex(number);
-		}
-
-		if(Z_TYPE_P(number) == IS_LONG) {
-			/* take INT32 on 32-bit, int64 on 64-bit */
-			type = (sizeof(zend_long) == 8)?FORMAT_TYPE_INT64:FORMAT_TYPE_INT32;
-		} else if(Z_TYPE_P(number) == IS_DOUBLE) {
-			type = FORMAT_TYPE_DOUBLE;
-		} else {
-			type = FORMAT_TYPE_INT32;
-		}
+	if(Z_TYPE_P(number) != IS_ARRAY) {
+		convert_scalar_to_number_ex(number);
+	} else {
+		convert_to_long(number);
 	}
 
-	if(Z_TYPE_P(number) != IS_DOUBLE && Z_TYPE_P(number) != IS_LONG) {
-		convert_scalar_to_number(number );
+	if(type == FORMAT_TYPE_DEFAULT) {
+		switch(Z_TYPE_P(number)) {
+			case IS_LONG:
+				/* take INT32 on 32-bit, int64 on 64-bit */
+				type = (sizeof(zend_long) == 8)?FORMAT_TYPE_INT64:FORMAT_TYPE_INT32;
+				break;
+			case IS_DOUBLE:
+				type = FORMAT_TYPE_DOUBLE;
+				break;
+			EMPTY_SWITCH_DEFAULT_CASE();
+		}
 	}
 
 	switch(type) {

ext/intl/tests/bug79212.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #79212 (NumberFormatter::format() may detect wrong type)
+--SKIPIF--
+<?php
+if (!extension_loaded('intl')) die('skip intl extension not available');
+if (!extension_loaded('gmp')) die('skip gmp extension not available');
+?>
+--FILE--
+<?php
+$fmt = new NumberFormatter('en_US', NumberFormatter::PATTERN_DECIMAL);
+var_dump($fmt->format(gmp_init('823749273428379492374')));
+
+$fmt = new NumberFormatter('en_US', NumberFormatter::PATTERN_DECIMAL);
+var_dump($fmt->format([1], NumberFormatter::TYPE_INT64));
+?>
+--EXPECT--
+string(21) "823749273428379400000"
+string(1) "1"