Commit a3bcc865642 for php.net
commit a3bcc86564251a697b0986670fe447a9cb02bdd8
Author: Weilin Du <weilindu@php.net>
Date: Tue Jun 23 23:12:12 2026 +0800
Fix GH-22395: Avoid truncating base_convert() output at 64 characters (#22406)
By using `ZEND_DOUBLE_MAX_LENGTH` instead of `(sizeof(double) << 3) + 1` we can fix the bug that base_convert() truncates output at 64 characters.
Fixes #22395
diff --git a/NEWS b/NEWS
index 8ee746eadee..df17e31c61f 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,8 @@ PHP NEWS
- Standard:
. Fixed bug GH-22360 (convert.base64-encode corruption on
incremental flush). (David Carlier)
+ . Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
+ (Weilin Du)
02 Jul 2026, PHP 8.4.23
diff --git a/ext/standard/math.c b/ext/standard/math.c
index 2a9cf5d4a6f..758b352f90f 100644
--- a/ext/standard/math.c
+++ b/ext/standard/math.c
@@ -24,6 +24,7 @@
#include "zend_exceptions.h"
#include "zend_multiply.h"
#include "zend_portability.h"
+#include "zend_strtod.h"
#include <float.h>
#include <math.h>
@@ -949,7 +950,7 @@ PHPAPI zend_string * _php_math_zvaltobase(zval *arg, int base)
if (Z_TYPE_P(arg) == IS_DOUBLE) {
double fvalue = floor(Z_DVAL_P(arg)); /* floor it just in case */
char *ptr, *end;
- char buf[(sizeof(double) << 3) + 1];
+ char buf[ZEND_DOUBLE_MAX_LENGTH];
/* Don't try to convert +/- infinity */
if (fvalue == ZEND_INFINITY || fvalue == -ZEND_INFINITY) {
diff --git a/ext/standard/tests/math/gh22395.phpt b/ext/standard/tests/math/gh22395.phpt
new file mode 100644
index 00000000000..73c2c66da19
--- /dev/null
+++ b/ext/standard/tests/math/gh22395.phpt
@@ -0,0 +1,11 @@
+--TEST--
+GH-22395 (base_convert outputs at most 64 characters)
+--FILE--
+<?php
+$result = base_convert(str_repeat("1", 61), 36, 16);
+var_dump(strlen($result));
+var_dump(substr($result, 0, 13));
+?>
+--EXPECT--
+int(78)
+string(13) "4b61b5e0639ff"