Repository navigation
Segmentation fault (index oob) in ext/bcmath/libbcmath/src/convert.c:155 #16265
Description
Description
The following code:
<?php
$variation_array = array(
'float -12.3456789000e10' => -12.3456789000e10,
);
$fusion = $variation_array;
require(__DIR__ . "/run_bcmath_tests_function.inc");
$dividends = ["15", "-15", "1", "-9", "14.14", "-16.60", "0.15", "-0.01"];
run_bcmath_tests($dividends, $fusion, "/", bcdiv(...));Resulted in this output:
/php-src/ext/bcmath/libbcmath/src/convert.c:155:68: runtime error: index 8791595 out of bounds for type 'const unsigned char[100]'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/bcmath/libbcmath/src/convert.c:155:68
PHP Version
PHP 8.4.0-dev
Operating System
ubuntu 22.04
Activity
ndossche commentedon Oct 6, 2024
Likely same root cause as #16262
cmb69 commentedon Oct 6, 2024
Simplified reproducer:
ndossche commentedon Oct 6, 2024
No, slightly different cause than #16262.
The problem here is that
quot_real_arr_sizeis 0, so the loopfor (i = 0; i < quot_real_arr_size - 1; i++) {goes OOB.However, the loop must write bytes because otherwise the numbers in bc_num are uninitialized.
Added early return case when result is 0 (#16697)