Skip to content
Permalink
Browse files

Fix integer overflow in StringUtil::implode

Reviewed By: ricklavoie

Differential Revision: D3623922

fbshipit-source-id: 136d124a850c07cc6c63535afc11d36499d576fc
  • Loading branch information...
markw65 authored and Hhvm Bot committed Aug 1, 2016
1 parent e264f04 commit 2c9a8fcc73a151608634d3e712973d192027c271
@@ -124,8 +124,8 @@ String StringUtil::Implode(const Variant& items, const String& delim,

req::vector<String> sitems;
sitems.reserve(size);
int len = 0;
int lenDelim = delim.size();
size_t len = 0;
size_t lenDelim = delim.size();
for (ArrayIter iter(items); iter; ++iter) {
sitems.emplace_back(iter.second().toString());
len += sitems.back().size() + lenDelim;
@@ -0,0 +1,5 @@
<?php
$stringLarge = str_repeat('*', 300289);
$arrayLarge = array_fill(0, 49981, '*');
$string_implode_2 = implode($stringLarge, $arrayLarge);
@@ -0,0 +1,2 @@

Fatal error: String length exceeded 2^31-2: 15008494201 in %s/test/slow/string_length_overflow/implode.php on line 5

0 comments on commit 2c9a8fc

Please sign in to comment.
You can’t perform that action at this time.