diff --git a/ext/standard/array.c b/ext/standard/array.c index eee260f224319..76e33e9868aa8 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -2924,8 +2924,8 @@ PHP_FUNCTION(range) /* If the range is given as strings, generate an array of characters. */ if (start_type >= IS_STRING || end_type >= IS_STRING) { - /* If one of the inputs is NOT a string */ - if (UNEXPECTED(start_type + end_type < 2*IS_STRING)) { + /* If one of the inputs is NOT a string nor single-byte string */ + if (UNEXPECTED(start_type < IS_STRING || end_type < IS_STRING)) { if (start_type < IS_STRING) { if (end_type != IS_ARRAY) { php_error_docref(NULL, E_WARNING, "Argument #1 ($start) must be a single byte string if" diff --git a/ext/standard/tests/array/range/gh13094.phpt b/ext/standard/tests/array/range/gh13094.phpt new file mode 100644 index 0000000000000..2e70adb65da72 --- /dev/null +++ b/ext/standard/tests/array/range/gh13094.phpt @@ -0,0 +1,29 @@ +--TEST-- +GH-13094 (range(9.9, '0') causes segmentation fault) +--FILE-- + +--EXPECT-- +array(10) { + [0]=> + float(9.9) + [1]=> + float(8.9) + [2]=> + float(7.9) + [3]=> + float(6.9) + [4]=> + float(5.9) + [5]=> + float(4.9) + [6]=> + float(3.9000000000000004) + [7]=> + float(2.9000000000000004) + [8]=> + float(1.9000000000000004) + [9]=> + float(0.9000000000000004) +}