git.squeep.com Git - portage-squeep/blob - dev-lang/php/files/php-5.6-intl-icu-memory-corruption.patch

   1 Based on the following upstream commits:
   2
   3 https://github.com/php/php-src/commit/45a05f38410d4a67c8c83c09906e2cfb42fc6e4c
   4 https://github.com/php/php-src/commit/534684d1042978f3c21caf9b665a7aca27f3f325
   5
   6 --- a/ext/intl/msgformat/msgformat_helpers.cpp
   7 +++ b/ext/intl/msgformat/msgformat_helpers.cpp
   8 @@ -27,6 +27,7 @@
   9  #include <unicode/timezone.h>
  10  #include <unicode/datefmt.h>
  11  #include <unicode/calendar.h>
  12 +#include <unicode/strenum.h>
  13
  14  #include <vector>
  15
  16 @@ -45,6 +46,7 @@ extern "C" {
  17
  18  #if U_ICU_VERSION_MAJOR_NUM * 10 + U_ICU_VERSION_MINOR_NUM >= 48
  19  #define HAS_MESSAGE_PATTERN 1
  20 +#define HAS_MISALLOCATE_MEMORY_BUG 1
  21  #endif
  22
  23  U_NAMESPACE_BEGIN
  24 @@ -345,6 +347,26 @@ static void umsg_set_timezone(MessageFormatter_object *mfo,
  25                 return; /* already done */
  26         }
  27
  28 +#ifdef HAS_MISALLOCATE_MEMORY_BUG
  29 +       /* There is a bug in ICU which prevents MessageFormatter::getFormats()
  30 +          to handle more than 10 formats correctly. The enumerator could be
  31 +          used to walk through the present formatters using getFormat(), which
  32 +          however seems to provide just a readonly access. This workaround
  33 +          prevents crash when there are > 10 formats but doesn't set any error.
  34 +          As a result, only DateFormatters with > 10 subformats are affected.
  35 +          This workaround should be ifdef'd out, when the bug has been fixed
  36 +          in ICU. */
  37 +       icu::StringEnumeration* fnames = mf->getFormatNames(err.code);
  38 +       if (!fnames || U_FAILURE(err.code)) {
  39 +               return;
  40 +       }
  41 +       count = fnames->count(err.code);
  42 +       delete fnames;
  43 +       if (count > 10) {
  44 +               return;
  45 +       }
  46 +#endif
  47 +
  48         formats = mf->getFormats(count);
  49
  50         if (formats == NULL) {
  51 --- /dev/null
  52 +++ b/ext/intl/tests/bug74484_MessageFormatter.phpt
  53 @@ -0,0 +1,35 @@
  54 +--TEST--
  55 +Bug #74484 MessageFormatter::formatMessage memory corruption with 11+ named placeholder
  56 +--SKIPIF--
  57 +<?php
  58 +if (!extension_loaded('intl'))
  59 +       die('skip intl extension not enabled');
  60 +if (version_compare(INTL_ICU_VERSION, '4.8') < 0)
  61 +       die('skip for ICU 4.8+');
  62 +?>
  63 +--FILE--
  64 +<?php
  65 +$text = "{a} {b} {c} {d} {e} {f} {g} {h} {i} {j} {k} {l}";
  66 +
  67 +$vars = array(
  68 +  'a' => 1,
  69 +  'b' => 2,
  70 +  'c' => 3,
  71 +  'd' => 4,
  72 +  'e' => 5,
  73 +  'f' => 6,
  74 +  'g' => 7,
  75 +  'h' => 8,
  76 +  'i' => 9,
  77 +  'j' => 10,
  78 +  'k' => 11,
  79 +  'l' => 12
  80 +);
  81 +
  82 +var_dump(MessageFormatter::formatMessage('en_US', $text, $vars));
  83 +
  84 +?>
  85 +==DONE==
  86 +--EXPECT--
  87 +string(26) "1 2 3 4 5 6 7 8 9 10 11 12"
  88 +==DONE==