Fix integer overflow in StringUtil::implode

Reviewed By: ricklavoie

Differential Revision: D3623922

fbshipit-source-id: 136d124a850c07cc6c63535afc11d36499d576fc

Author: mwilliams@fb.com

hphp/runtime/base/string-util.cpp

@@ -123,9 +123,9 @@ String StringUtil::Implode(const Variant& items, const String& delim,
   if (size == 0) return empty_string();
 
   String* sitems = (String*)req::malloc(size * sizeof(String));
-  int len = 0;
-  int lenDelim = delim.size();
-  int i = 0;
+  size_t len = 0;
+  size_t lenDelim = delim.size();
+  size_t i = 0;
   for (ArrayIter iter(items); iter; ++iter) {
     new (&sitems[i]) String(iter.second().toString());
     len += sitems[i].size() + lenDelim;

hphp/test/slow/string_length_overflow/implode.php

@@ -0,0 +1,5 @@
+<?php
+
+$stringLarge = str_repeat('*', 300289);
+$arrayLarge = array_fill(0, 49981, '*');
+$string_implode_2 = implode($stringLarge, $arrayLarge);

hphp/test/slow/string_length_overflow/implode.php.expectf

@@ -0,0 +1,2 @@
+
+Fatal error: String length exceeded 2^31-2: 15008494201 in %s/test/slow/string_length_overflow/implode.php on line 5