From f3a78df7d4c297461cf1794c5821c836a546289c Mon Sep 17 00:00:00 2001
From: Andy Postnikov <apostnikov@gmail.com>
Date: Wed, 4 Nov 2026 17:43:57 +0100
Subject: [PATCH] fix 2^52 bound on 32-bit in msgpack_unserialize_uint64

---
 msgpack_unpack.c                 |  2 +-
 tests/issue067_32bit_double.phpt | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 tests/issue067_32bit_double.phpt

diff --git a/msgpack_unpack.c b/msgpack_unpack.c
index b946532..da71f99 100644
--- a/msgpack_unpack.c
+++ b/msgpack_unpack.c
@@ -437,7 +437,7 @@ int msgpack_unserialize_uint64(msgpack_unpack_data *unpack, uint64_t data, zval
 
     if (data <= (uint64_t) ZEND_LONG_MAX) {
         ZVAL_LONG(*obj, data);
-    } else if (data <= 1L<<52) {
+    } else if (data <= (uint64_t) 1 << 52) {
         ZVAL_DOUBLE(*obj, data);
     } else {
         char buf[0x20] = {0}, *ptr = print_u64_to_buf(&buf[sizeof(buf)-1], data);
diff --git a/tests/issue067_32bit_double.phpt b/tests/issue067_32bit_double.phpt
new file mode 100644
index 0000000..7afc0e6
--- /dev/null
+++ b/tests/issue067_32bit_double.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Issue #67 (uint64_t above ZEND_LONG_MAX up to 2^52 unpacks as float on 32-bit)
+--SKIPIF--
+<?php
+if (!extension_loaded("msgpack")) {
+    die("skip");
+}
+if (PHP_INT_SIZE !== 4)
+    die("skip this test is for 32-bit platforms only");
+?>
+--FILE--
+<?php
+var_dump(msgpack_unpack("\xcf"."\x00\x00\x00\x00"."\x80\x00\x00\x00")); // 2^31
+var_dump(msgpack_unpack("\xcf"."\x00\x00\x00\x01"."\x00\x00\x00\x00")); // 2^32
+var_dump(msgpack_unpack("\xcf"."\x00\x10\x00\x00"."\x00\x00\x00\x00")); // 2^52
+var_dump(msgpack_unpack("\xcf"."\x00\x10\x00\x00"."\x00\x00\x00\x01")); // 2^52 + 1
+?>
+OK
+--EXPECT--
+float(2147483648)
+float(4294967296)
+float(4503599627370496)
+string(16) "4503599627370497"
+OK