Skip to content

Commit 9aadcb1

Browse files
committed
Restore digit check in mb_decode_numericentity()
I replaced it with a multiplication overflow check in 18599f9. However, we need both, because the code for restoring the number can't handle numbers with many leading zeros right now and I don't feel like teaching it.
1 parent acc616c commit 9aadcb1

File tree

2 files changed

+3
-1
lines changed

2 files changed

+3
-1
lines changed

ext/mbstring/libmbfl/mbfl/mbfilter.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2554,7 +2554,7 @@ collector_decode_htmlnumericentity(int c, void *data)
25542554
f = 0;
25552555
if (c >= 0x30 && c <= 0x39) { /* '0' - '9' */
25562556
s = pc->cache;
2557-
if (s > INT_MAX/10) {
2557+
if (pc->digit > 9 || s > INT_MAX/10) {
25582558
pc->status = 0;
25592559
f = 1;
25602560
} else {

ext/mbstring/tests/mb_decode_numericentity.phpt

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ echo mb_decode_numericentity('&#1000000000', $convmap), "\n";
1919
echo mb_decode_numericentity('&#9000000000', $convmap), "\n";
2020
echo mb_decode_numericentity('&#10000000000', $convmap), "\n";
2121
echo mb_decode_numericentity('&#100000000000', $convmap), "\n";
22+
echo mb_decode_numericentity('&#000000000000', $convmap), "\n";
2223

2324
?>
2425
--EXPECT--
@@ -29,3 +30,4 @@ aŒbœcŠdše€fg
2930
&#9000000000
3031
&#10000000000
3132
&#100000000000
33+
&#000000000000

0 commit comments

Comments
 (0)