diff options
Diffstat (limited to 'ext/standard/scanf.c')
| -rw-r--r-- | ext/standard/scanf.c | 28 |
1 files changed, 20 insertions, 8 deletions
diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c index ed0ef42eb..c40a29a63 100644 --- a/ext/standard/scanf.c +++ b/ext/standard/scanf.c @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: scanf.c,v 1.31.2.2 2006/01/01 12:50:15 sniper Exp $ */ +/* $Id: scanf.c,v 1.31.2.3 2006/08/04 20:34:31 tony2001 Exp $ */ /* scanf.c -- @@ -732,7 +732,7 @@ PHPAPI int php_sscanf_internal( char *string, char *format, if (*end == '$') { format = end+1; ch = format++; - objIndex = varStart + value; + objIndex = varStart + value - 1; } } @@ -762,7 +762,9 @@ PHPAPI int php_sscanf_internal( char *string, char *format, switch (*ch) { case 'n': if (!(flags & SCAN_SUPPRESS)) { - if (numVars) { + if (numVars && objIndex >= argCount) { + break; + } else if (numVars) { zend_uint refcount; current = args[objIndex++]; @@ -888,7 +890,9 @@ PHPAPI int php_sscanf_internal( char *string, char *format, } } if (!(flags & SCAN_SUPPRESS)) { - if (numVars) { + if (numVars && objIndex >= argCount) { + break; + } else if (numVars) { zend_uint refcount; current = args[objIndex++]; @@ -932,7 +936,9 @@ PHPAPI int php_sscanf_internal( char *string, char *format, goto done; } if (!(flags & SCAN_SUPPRESS)) { - if (numVars) { + if (numVars && objIndex >= argCount) { + break; + } else if (numVars) { current = args[objIndex++]; zval_dtor( *current ); ZVAL_STRINGL( *current, string, end-string, 1); @@ -1089,7 +1095,9 @@ PHPAPI int php_sscanf_internal( char *string, char *format, value = (int) (*fn)(buf, NULL, base); if ((flags & SCAN_UNSIGNED) && (value < 0)) { sprintf(buf, "%u", value); /* INTL: ISO digit */ - if (numVars) { + if (numVars && objIndex >= argCount) { + break; + } else if (numVars) { /* change passed value type to string */ current = args[objIndex++]; convert_to_string( *current ); @@ -1098,7 +1106,9 @@ PHPAPI int php_sscanf_internal( char *string, char *format, add_index_string(*return_value, objIndex++, buf, 1); } } else { - if (numVars) { + if (numVars && objIndex >= argCount) { + break; + } else if (numVars) { current = args[objIndex++]; convert_to_long( *current ); Z_LVAL(**current) = value; @@ -1206,7 +1216,9 @@ PHPAPI int php_sscanf_internal( char *string, char *format, double dvalue; *end = '\0'; dvalue = zend_strtod(buf, NULL); - if (numVars) { + if (numVars && objIndex >= argCount) { + break; + } else if (numVars) { current = args[objIndex++]; convert_to_double( *current ); Z_DVAL_PP( current ) = dvalue; |