[packages/php.git] / php-5.3.7-bug-50363.patch

--- PHP_5_3/ext/standard/filters.c	2011/05/24 23:49:04	311406
+++ PHP_5_3/ext/standard/filters.c	2011/05/24 23:49:26	311407
@@ -1050,20 +1050,16 @@
 				}
 			} /* break is missing intentionally */
 
-			case 2: {
-				unsigned int nbl;
-	
+			case 2: {	
 				if (icnt <= 0) {
 					goto out;
 				}
-				nbl = (*ps >= 'A' ? *ps - 0x37 : *ps - 0x30);
 
-				if (nbl > 15) {
+				if (!isxdigit((int) *ps)) {
 					err = PHP_CONV_ERR_INVALID_SEQ;
 					goto out;
 				}
-				next_char = (next_char << 4) | nbl;
-
+				next_char = (next_char << 4) | (*ps >= 'A' ? *ps - 0x37 : *ps - 0x30);
 				scan_stat++;
 				ps++, icnt--;
 				if (scan_stat != 3) {
Commit	Line	Data
fb98beff ER	1	--- PHP_5_3/ext/standard/filters.c 2011/05/24 23:49:04 311406
	2	+++ PHP_5_3/ext/standard/filters.c 2011/05/24 23:49:26 311407
	3	@@ -1050,20 +1050,16 @@
	4	}
	5	} /* break is missing intentionally */
	6
	7	- case 2: {
	8	- unsigned int nbl;
	9	-
	10	+ case 2: {
	11	if (icnt <= 0) {
	12	goto out;
	13	}
	14	- nbl = (ps >= 'A' ? ps - 0x37 : *ps - 0x30);
	15
	16	- if (nbl > 15) {
	17	+ if (!isxdigit((int) *ps)) {
	18	err = PHP_CONV_ERR_INVALID_SEQ;
	19	goto out;
	20	}
	21	- next_char = (next_char << 4) \| nbl;
	22	-
	23	+ next_char = (next_char << 4) \| (ps >= 'A' ? ps - 0x37 : *ps - 0x30);
	24	scan_stat++;
	25	ps++, icnt--;
	26	if (scan_stat != 3) {