mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 09:54:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.2' into PHP-8.3

Browse Source 
* PHP-8.2:
  Fix GH-16411: gmp_export() can cause overflow
This commit is contained in:
Christoph M. Becker 2024-10-15 15:58:03 +02:00
commit ea6f78eac8
No known key found for this signature in database
GPG Key ID: D66C9593118BCCB6
3 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -39,6 +39,7 @@ PHP NEWS
- GMP:
. Fixed floating point exception bug with gmp_pow when using
large exposant values. (David Carlier).
. Fixed bug GH-16411 (gmp_export() can cause overflow). (cmb)
- MBstring:
. Fixed bug GH-16361 (mb_substr overflow on start/length arguments).

10
ext/gmp/gmp.c
View File

@ -1002,8 +1002,14 @@ ZEND_FUNCTION(gmp_export)
if (mpz_sgn(gmpnumber) == 0) {
RETVAL_EMPTY_STRING();
} else {
size_t bits_per_word = size * 8;
size_t count = (mpz_sizeinbase(gmpnumber, 2) + bits_per_word - 1) / bits_per_word;
ZEND_ASSERT(size > 0);
size_t size_in_base_2 = mpz_sizeinbase(gmpnumber, 2);
if (size > ZEND_LONG_MAX / 4 || size_in_base_2 > SIZE_MAX - (size_t) size * 8 + 1) {
zend_argument_value_error(2, "is too large for argument #1 ($num)");
RETURN_THROWS();
}
size_t bits_per_word = (size_t) size * 8;
size_t count = (size_in_base_2 + bits_per_word - 1) / bits_per_word;
zend_string *out_string = zend_string_safe_alloc(count, size, 0, 0);
mpz_export(ZSTR_VAL(out_string), NULL, order, size, endian, 0, gmpnumber);

11
ext/gmp/tests/gh16411.phpt Normal file
View File

@ -0,0 +1,11 @@
--TEST--
GH-16411 (gmp_export() can cause overflow)
--EXTENSIONS--
gmp
--FILE--
<?php
gmp_export("-9223372036854775808", PHP_INT_MAX, PHP_INT_MIN);
?>
--EXPECTF--
Fatal error: Uncaught ValueError: gmp_export(): Argument #2 ($word_size) is too large for argument #1 ($num) in %s:%d
%A