Skip to content

ext/standard: Fix setlocale() NUL byte truncation#22843

Open
LamentXU123 wants to merge 12 commits into
php:masterfrom
LamentXU123:NUL-standard
Open

ext/standard: Fix setlocale() NUL byte truncation#22843
LamentXU123 wants to merge 12 commits into
php:masterfrom
LamentXU123:NUL-standard

Conversation

@LamentXU123

Copy link
Copy Markdown
Member
<?php
var_dump(setlocale(LC_ALL, "C\0invalid"));
string(1) "C"

See: https://3v4l.org/rHId2#v
New argument logic in try_setlocale_zval is inevitable because we need to know the argument position when we raise the ValueError (both the second and the third parameter of the setlocale function have the truncation issue)

Comment thread ext/standard/string.c Outdated
Comment thread ext/standard/string.c Outdated
Comment thread ext/standard/tests/strings/setlocale_null_byte.phpt Outdated
Comment thread ext/standard/string.c
@LamentXU123
LamentXU123 requested a review from arnaud-lb July 24, 2026 09:26
Comment thread ext/standard/string.c Outdated
zend_wrong_parameter_type_error(i + 2, Z_EXPECTED_STRING_OR_NULL, &args[i]);
goto out;
}
num_args = 1;

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggest to throw if num_args > 1 here, otherwise we silently ignore extra args

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In which case we need to throw an ArgumentCountError when locale is an array and we have more than 2 args

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The num_args = 1 assignment can be dropped now :)

Comment thread ext/standard/string.c Outdated
zval *elem;
ZEND_HASH_FOREACH_VAL(Z_ARRVAL(args[i]), elem) {
result = try_setlocale_zval(cat, elem);
result = try_setlocale_zval(cat, elem, i + 2);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is not necessary anymore as the array argument is always 2

@LamentXU123
LamentXU123 marked this pull request as draft July 24, 2026 09:53
@LamentXU123
LamentXU123 marked this pull request as ready for review July 24, 2026 09:55
@LamentXU123
LamentXU123 requested a review from arnaud-lb July 24, 2026 09:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants