From 73a9e81b586bf9201eebe3f2ac4d6869ae1ea8c4 Mon Sep 17 00:00:00 2001
From: Weilin Du <weilindu@php.net>
Date: Tue, 23 Jun 2026 16:30:37 +0800
Subject: [PATCH] Fix GH-22395: Avoid truncating base_convert() output at 64
 characters

---
 NEWS                                 |  2 ++
 ext/standard/math.c                  |  3 ++-
 ext/standard/tests/math/gh22395.phpt | 11 +++++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/math/gh22395.phpt

diff --git a/NEWS b/NEWS
index 8ee746eadee2..df17e31c61f6 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug GH-22360 (convert.base64-encode corruption on
     incremental flush). (David Carlier)
+  . Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
+    (Weilin Du)
 
 02 Jul 2026, PHP 8.4.23
 
diff --git a/ext/standard/math.c b/ext/standard/math.c
index 2a9cf5d4a6ff..758b352f90ff 100644
--- a/ext/standard/math.c
+++ b/ext/standard/math.c
@@ -24,6 +24,7 @@
 #include "zend_exceptions.h"
 #include "zend_multiply.h"
 #include "zend_portability.h"
+#include "zend_strtod.h"
 
 #include <float.h>
 #include <math.h>
@@ -949,7 +950,7 @@ PHPAPI zend_string * _php_math_zvaltobase(zval *arg, int base)
 	if (Z_TYPE_P(arg) == IS_DOUBLE) {
 		double fvalue = floor(Z_DVAL_P(arg)); /* floor it just in case */
 		char *ptr, *end;
-		char buf[(sizeof(double) << 3) + 1];
+		char buf[ZEND_DOUBLE_MAX_LENGTH];
 
 		/* Don't try to convert +/- infinity */
 		if (fvalue == ZEND_INFINITY || fvalue == -ZEND_INFINITY) {
diff --git a/ext/standard/tests/math/gh22395.phpt b/ext/standard/tests/math/gh22395.phpt
new file mode 100644
index 000000000000..73c2c66da199
--- /dev/null
+++ b/ext/standard/tests/math/gh22395.phpt
@@ -0,0 +1,11 @@
+--TEST--
+GH-22395 (base_convert outputs at most 64 characters)
+--FILE--
+<?php
+$result = base_convert(str_repeat("1", 61), 36, 16);
+var_dump(strlen($result));
+var_dump(substr($result, 0, 13));
+?>
+--EXPECT--
+int(78)
+string(13) "4b61b5e0639ff"