Skip to content

Fix GH-13094: range(9.9, '0') causes segmentation fault - #13105

Closed
ndossche wants to merge 2 commits into
php:PHP-8.3from
ndossche:range-segv
Closed

ndossche wants to merge 2 commits into
php:PHP-8.3from
ndossche:range-segv

Conversation

@ndossche

@ndossche ndossche commented Jan 9, 2024

Copy link
Copy Markdown
Member

start_type + end_type < 2*IS_STRING is not right, in this test case the types are start_type==5 (IS_DOUBLE), end_type==7 (IS_ARRAY). The IS_ARRAY type is a sentinel to disambiguate single-byte strings. The path must be taken when one of the types is not a string nor a single-byte string. Therefore, use < IS_STRING with an OR condition.

`start_type + end_type < 2*IS_STRING` is not right, in this test case
the types are start_type==5 (IS_DOUBLE), end_type==7 (IS_ARRAY).
The IS_ARRAY type is a sentinel to disambiguate single-byte strings.
The path must be taken when one of the types is not a string nor a
single-byte string. Therefore, use < IS_STRING with an OR condition.
@ndossche
ndossche requested a review from Girgias January 9, 2024 19:15
@ndossche
ndossche requested a review from bukka as a code owner January 9, 2024 19:15
@ndossche ndossche linked an issue Jan 9, 2024 that may be closed by this pull request
Comment thread ext/standard/array.c
if (start_type >= IS_STRING || end_type >= IS_STRING) {
/* If one of the inputs is NOT a string */
if (UNEXPECTED(start_type + end_type < 2*IS_STRING)) {
/* If one of the inputs is NOT a string nor single-byte string */

@ndossche ndossche Jan 9, 2024 •

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Gina, please double-check my edit to this comment :-)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This took a hot minute, but I think this is correct, yes.

As the initial logic was that one of the inputs is a valid string (be single byte or not) and the other one is either an int or float. Thus it "wouldn't" be more than 2*IS_STRING in my head.

@Girgias Girgias left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't know why I didn't do this in the first place. Was probably trying to be smart.

Comment thread ext/standard/array.c
if (start_type >= IS_STRING || end_type >= IS_STRING) {
/* If one of the inputs is NOT a string */
if (UNEXPECTED(start_type + end_type < 2*IS_STRING)) {
/* If one of the inputs is NOT a string nor single-byte string */

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This took a hot minute, but I think this is correct, yes.

As the initial logic was that one of the inputs is a valid string (be single byte or not) and the other one is either an int or float. Thus it "wouldn't" be more than 2*IS_STRING in my head.

@ndossche ndossche closed this in 1d6f344 Jan 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

range(9.9, '0') causes segmentation fault

2 participants