Repository navigation
ini_parse_quantity() accepts invalid arguments as valid #11876
Description
Description
While writing a polyfill for ini_parse_quantity() I found some invalid inputs that are wrongly accepted as valid.
See https://3v4l.org/ON6U1#v8.2.9 for a live demo
The following code:
<?php
var_dump(ini_parse_quantity('0x0x12'));
var_dump(ini_parse_quantity('0b+10'));
var_dump(ini_parse_quantity('0o+10'));
var_dump(ini_parse_quantity('0x+10'));
var_dump(ini_parse_quantity('0b 10'));
var_dump(ini_parse_quantity('0o 10'));
var_dump(ini_parse_quantity('0x 10'));Resulted in this output:
int(18)
int(2)
int(8)
int(16)
int(2)
int(8)
int(16)
But I expected this output instead:
E_WARNING that the data is invalid - similar to other invalid arguments.
PHP Version
8.2.9
Operating System
No response
Activity
Girgias commentedon Aug 8, 2023
The "issue" is the call to ```ZEND_STRTOUL()``, this is part of the issue when introducing support for binary and octal prefixes in #9560
The whitespace and prefix is stripped away before passing it to the C
strtoul()(or whatever platform-dependent function) which will also strip+,-, whitespace and a hex prefix (as this is the only one supported).The warnings for:
are also a tad weird.
I don't really see a good way to fix this, but will try. @arnaud-lb what is your opinion on this? (well after you enjoyed your holiday)
Fix phpGH-11876: ini_parse_quantity() accepts invalid quantities
Fix GH-11876: ini_parse_quantity() accepts invalid quantities
Merge branch 'PHP-8.2' into PHP-8.3
Merge branch 'PHP-8.3'