Skip to content

ext/intl: Fix UConverter::transcode() substitution length truncation#22199

Open
LamentXU123 wants to merge 2 commits into
php:masterfrom
LamentXU123:uconverter-bug-fix
Open

ext/intl: Fix UConverter::transcode() substitution length truncation#22199
LamentXU123 wants to merge 2 commits into
php:masterfrom
LamentXU123:uconverter-bug-fix

Conversation

@LamentXU123
Copy link
Copy Markdown
Contributor

@LamentXU123 LamentXU123 commented Jun 1, 2026

Now, in UConverter::transcode() we masked the from_subst and to_subst option string length with 0x7F before passing them to ucnv_setSubstChars(). This makes every string with length greater than 127 be silently truncated.

For example, a string with length 129 will now be truncated as with length 1.

POC:

<?php
$subst = str_repeat('A', 129);

var_dump(UConverter::transcode('abc', 'UTF-8', 'ASCII', ['from_subst' => $subst]));
var_dump(intl_get_error_code());
var_dump(UConverter::transcode('abc', 'UTF-8', 'ASCII', ['to_subst' => $subst]));
var_dump(intl_get_error_code());
?>

Will return

string(3) "abc"
int(0)
string(3) "abc"
int(0)

While I suggest to directly reject strings longer than 0x7F, that is

bool(false)
int(1)
bool(false)
int(1)

Reproduce

Intentionally targeting master as this is technically not a bug fix.

Comment thread ext/intl/tests/uconverter_transcode_subst_length.phpt Outdated
@devnexen
Copy link
Copy Markdown
Member

devnexen commented Jun 1, 2026

is indeed a correct diagnostic otherwise.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants