@@ -570,15 +570,15 @@ static int ValidateFormat(const char *format, uint32_t numVars, uint32_t *totalS
570570 * return_value set with the results of the scan
571571 */
572572
573- PHPAPI int php_sscanf_internal ( char * string , const char * format ,
573+ PHPAPI int php_sscanf_internal (const char * string , const char * format ,
574574 uint32_t argCount , zval * args ,
575575 zval * return_value )
576576{
577577 int numVars , nconversions ;
578578 int result ;
579579 zend_long value ;
580580 zend_ulong objIndex ;
581- char * end ;
581+ const char * end ;
582582 const char * baseString ;
583583 zval * current ;
584584 char op = 0 ;
@@ -589,8 +589,6 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
589589 const char * ch ;
590590 char sch ;
591591 int flags ;
592- char buf [64 ]; /* Temporary buffer to hold scanned number
593- * strings before they are passed to strtoul() */
594592
595593 numVars = argCount ;
596594 if (numVars < 0 ) {
@@ -694,6 +692,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
694692 flags |= SCAN_SUPPRESS ;
695693 ch = format ++ ;
696694 } else if ( isdigit (UCHAR (* ch ))) {
695+ char * end = NULL ;
697696 zend_ulong assignment_index = ZEND_STRTOUL (format - 1 , & end , 10 );
698697 if (* end == '$' ) {
699698 format = end + 1 ;
@@ -917,7 +916,10 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
917916 }
918917 break;
919918*/
920- case 'i' :
919+ case 'i' : {
920+ /* Temporary buffer to hold scanned number */
921+ char buf [64 ];
922+ char * buf_end ;
921923 /*
922924 * Scan an unsigned or signed integer.
923925 */
@@ -929,7 +931,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
929931 }
930932
931933 flags |= SCAN_SIGNOK | SCAN_NODIGITS | SCAN_NOZERO ;
932- for (end = buf ; width > 0 ; width -- ) {
934+ for (buf_end = buf ; width > 0 ; width -- ) {
933935 switch (* string ) {
934936 /*
935937 * The 0 digit has special meaning at the beginning of
@@ -967,7 +969,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
967969 base = 10 ;
968970 }
969971 if (base <= 8 ) {
970- break ;
972+ break ;
971973 }
972974 flags &= ~(SCAN_SIGNOK | SCAN_XOK | SCAN_NODIGITS );
973975 goto addToInt ;
@@ -990,7 +992,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
990992 break ;
991993
992994 case 'x' : case 'X' :
993- if ((flags & SCAN_XOK ) && (end == buf + 1 )) {
995+ if ((flags & SCAN_XOK ) && (buf_end == buf + 1 )) {
994996 base = 16 ;
995997 flags &= ~SCAN_XOK ;
996998 goto addToInt ;
@@ -1007,7 +1009,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
10071009 /*
10081010 * Add the character to the temporary buffer.
10091011 */
1010- * end ++ = * string ++ ;
1012+ * buf_end ++ = * string ++ ;
10111013 if (* string == '\0' ) {
10121014 break ;
10131015 }
@@ -1022,8 +1024,8 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
10221024 underflow = 1 ;
10231025 }
10241026 goto done ;
1025- } else if (end [-1 ] == 'x' || end [-1 ] == 'X' ) {
1026- end -- ;
1027+ } else if (buf_end [-1 ] == 'x' || buf_end [-1 ] == 'X' ) {
1028+ buf_end -- ;
10271029 string -- ;
10281030 }
10291031
@@ -1033,14 +1035,14 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
10331035 * to a string since PHP only supports signed values.
10341036 */
10351037 if (!(flags & SCAN_SUPPRESS )) {
1036- * end = '\0' ;
1038+ * buf_end = '\0' ;
10371039 value = (zend_long ) (* fn )(buf , NULL , base );
10381040 if ((flags & SCAN_UNSIGNED ) && (value < 0 )) {
10391041 snprintf (buf , sizeof (buf ), ZEND_ULONG_FMT , value ); /* INTL: ISO digit */
10401042 if (assignToVariables && objIndex >= argCount ) {
10411043 break ;
10421044 } else if (assignToVariables ) {
1043- /* change passed value type to string */
1045+ /* change passed value type to string */
10441046 current = args + objIndex ++ ;
10451047 ZEND_TRY_ASSIGN_REF_STRING (current , buf );
10461048 } else {
@@ -1058,8 +1060,12 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
10581060 }
10591061 }
10601062 break ;
1063+ }
10611064
1062- case 'f' :
1065+ case 'f' : {
1066+ /* Temporary buffer to hold scanned number */
1067+ char buf [64 ];
1068+ char * buf_end ;
10631069 /*
10641070 * Scan a floating point number
10651071 */
@@ -1068,7 +1074,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
10681074 width = sizeof (buf ) - 1 ;
10691075 }
10701076 flags |= SCAN_SIGNOK | SCAN_NODIGITS | SCAN_PTOK | SCAN_EXPOK ;
1071- for (end = buf ; width > 0 ; width -- ) {
1077+ for (buf_end = buf ; width > 0 ; width -- ) {
10721078 switch (* string ) {
10731079 case '0' : case '1' : case '2' : case '3' :
10741080 case '4' : case '5' : case '6' : case '7' :
@@ -1111,7 +1117,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
11111117 /*
11121118 * Add the character to the temporary buffer.
11131119 */
1114- * end ++ = * string ++ ;
1120+ * buf_end ++ = * string ++ ;
11151121 if (* string == '\0' ) {
11161122 break ;
11171123 }
@@ -1136,10 +1142,10 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
11361142 /*
11371143 * We got a bad exponent ('e' and maybe a sign).
11381144 */
1139- end -- ;
1145+ buf_end -- ;
11401146 string -- ;
1141- if (* end != 'e' && * end != 'E' ) {
1142- end -- ;
1147+ if (* buf_end != 'e' && * buf_end != 'E' ) {
1148+ buf_end -- ;
11431149 string -- ;
11441150 }
11451151 }
@@ -1149,7 +1155,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
11491155 */
11501156 if (!(flags & SCAN_SUPPRESS )) {
11511157 double dvalue ;
1152- * end = '\0' ;
1158+ * buf_end = '\0' ;
11531159 dvalue = zend_strtod (buf , NULL );
11541160 if (assignToVariables && objIndex >= argCount ) {
11551161 break ;
@@ -1161,6 +1167,7 @@ PHPAPI int php_sscanf_internal( char *string, const char *format,
11611167 }
11621168 }
11631169 break ;
1170+ }
11641171 } /* switch (op) */
11651172 nconversions ++ ;
11661173 } /* while (*format != '\0') */
0 commit comments