Fix integer overflow in StringUtil::implode

Reviewed By: ricklavoie Differential Revision: D3623922 fbshipit-source-id: 136d124a850c07cc6c63535afc11d36499d576fc
facebook · Aug 1, 2016 · 86c5177 · 86c5177
1 parent 1c9f329
commit 86c5177
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/hphp/runtime/base/string-util.cpp b/hphp/runtime/base/string-util.cpp
@@ -124,8 +124,8 @@ String StringUtil::Implode(const Variant& items, const String& delim,
 
   req::vector<String> sitems;
   sitems.reserve(size);
-  int len = 0;
-  int lenDelim = delim.size();
+  size_t len = 0;
+  size_t lenDelim = delim.size();
   for (ArrayIter iter(items); iter; ++iter) {
     sitems.emplace_back(iter.second().toString());
     len += sitems.back().size() + lenDelim;

diff --git a/hphp/test/slow/string_length_overflow/implode.php b/hphp/test/slow/string_length_overflow/implode.php
@@ -0,0 +1,5 @@
+<?php
+
+$stringLarge = str_repeat('*', 300289);
+$arrayLarge = array_fill(0, 49981, '*');
+$string_implode_2 = implode($stringLarge, $arrayLarge);
diff --git a/hphp/test/slow/string_length_overflow/implode.php.expectf b/hphp/test/slow/string_length_overflow/implode.php.expectf
@@ -0,0 +1,2 @@
+
+Fatal error: String length exceeded 2^31-2: 15008494201 in %s/test/slow/string_length_overflow/implode.php on line 5
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@

		Fatal error: String length exceeded 2^31-2: 15008494201 in %s/test/slow/string_length_overflow/implode.php on line 5