php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-15712: overflow on float print with precision ini large value.

Browse Source 
When allocating enough room for floats, the allocator used overflows with
large ndigits/EG(precision) value which used an signed integer to
increase the size of thebuffer.
Testing with the zend operator directly is enough to trigger
the issue rather than higher level math interface.

close GH-15715
This commit is contained in:
David Carlier
2024-09-02 18:03:28 +01:00
parent 791a6ef19c
commit 503d9145e0
3 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -2,6 +2,10 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.2.25
- Core:
. Fixed bug GH-15712: zend_strtod overflow with precision INI set on
large value. (David Carlier)
- Date:
. Fixed bug GH-15582: Crash when not calling parent constructor of
DateTimeZone. (Derick)

9
Zend/tests/gh15712.phpt Normal file
View File

@@ -0,0 +1,9 @@
--TEST--
GH-15712: overflow on real number printing
--FILE--
<?php
ini_set('precision', 1100000000);
echo -1 * (2 ** -10);
?>
--EXPECTF--
%s

6
Zend/zend_strtod.c
View File

@@ -3613,11 +3613,11 @@ rv_alloc(i) int i;
rv_alloc(int i)
#endif
{
int j, k, *r;
int k, *r;
j = sizeof(ULong);
size_t j = sizeof(ULong);
for(k = 0;
sizeof(Bigint) - sizeof(ULong) - sizeof(int) + (size_t)j <= (size_t)i;
sizeof(Bigint) - sizeof(ULong) - sizeof(int) + j <= (size_t)i;
j <<= 1)
k++;
r = (int*)Balloc(k);