Bug #51397 [Ver->Bgs]: Math calculation bug

From: Date: Tue, 08 Jun 2010 12:38:35 +0000
Subject: Bug #51397 [Ver->Bgs]: Math calculation bug
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-151200@lists.php.net to get a copy of this message
Edit report at http://bugs.php.net/bug.php?id=51397&edit=1

 ID:               51397
 Updated by:       tony2001@php.net
 Reported by:      emanuel dot dejanu at humaninfo dot ro
 Summary:          Math calculation bug
-Status:           Verified
+Status:           Bogus
 Type:             Bug
 Package:          Scripting Engine problem
 Operating System: FREEBSD & LINUX
 PHP Version:      5.2.13

 New Comment:

>It looks to me that this code has an integer overflow at some point
Yep.
And it's easy to see where exactly it overflows:
Add var_dump($h); at the end of for() loop, you'll see it yourself:
int(177638)
int(5862122)
int(193450012)
int(2088883122)
int(213666243)
int(-1538948595)
int(754303898)
int(754303898)


Previous Comments:
------------------------------------------------------------------------
[2010-04-25 12:46:01] pajoye@php.net

It looks to me that this code has an integer overflow at some point. I
would suggest to use ext/hash if you need reliable hashes or add integer
overflow checks in your code.

This behavior can't be seen on windows. On this platform the long type
has the same size, no matter the architecture (32bit on both x64 and
x86).

------------------------------------------------------------------------
[2010-04-25 12:29:10] cimodev at me dot com

My Result on OpenSuse 11.0 - 64bit with PHP 5.3.2:
229416432419738

-----

On Debian 64bit:

PHP 5.3.2-0.dotdeb.1 with Suhosin-Patch (cli) (built: Mar  9 2010
11:42:01)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
    with Suhosin v0.9.29, Copyright (c) 2007, by SektionEins GmbH

229416432419738

Maybe this bug occurres primarily on 32bit systems... I have none here
for testing

------------------------------------------------------------------------
[2010-04-22 21:54:37] whatrevolution at yahoo dot com

My answer to myhash('CL6.1.7'): 229416432419738

PHP Version 5.2.10-2ubuntu6.4

System 	Linux 2.6.31-20-generic x86_64
Build Date 	Jan 6 2010 22:36:47
Server API 	Apache 2.0 Handler 
PHP API 	20041225
PHP Extension 	20060613
Zend Extension 	220060519
Debug Build 	no
Thread Safety 	disabled
Zend Memory Manager 	enabled 

Apache/2.2.12 (Ubuntu)

------------------------------------------------------------------------
[2010-03-26 11:56:42] fa@php.net

Verified with 5.2.13 on Debian (default configure)

Verified in the Debian 5.2.6+lenny4 PHP (just for completeness)

Correct result with 5.3.2 on Gentoo

------------------------------------------------------------------------
[2010-03-26 08:20:19] emanuel dot dejanu at humaninfo dot ro

Description:
------------

I have used the code from the test script on my development machine
(Windows Professional 7 32bit) with php 5.2.12 and is working correctly
but when I have deployed on my production machine that is FreeBSD 6.3
32bit with the same php version 5.2.12 is giving wrong results
(-2147483593). I also run this on other production machine that is
RedHat 5 32bit with php 5.2.6 and is also giving wrong results
(-2147483593).

I can not test with php 5.2.13 on production machines (virtual
hosting).
On windows is giving the correctly result (754303898) with PHP 5.2.12
and PHP 5.3.1. I am running in 32bit platform on all machines.

-------------------------------------------------------------------

PHP_INT_SIZE: 4

System => FreeBSD somehost.com 6.3-RELEASE FreeBSD 6.3-RELEASE #6: Wed
Oc
t 21 09:32:42 MDT 2009     root@fc:/usr/src/sys/i386/compile/VKERN i386
Build Date => Mar  3 2010 12:51:00
Configure Command =>  './configure'  '--with-layout=GNU'
'--with-config-file-sca
n-dir=/usr/local/etc/php' '--disable-all' '--enable-libxml'
'--with-libxml-dir=/
usr/local' '--enable-reflection' '--program-prefix='
'--enable-fastcgi'
'--with-
apxs2=/usr/local/sbin/apxs' '--with-regex=php' '--with-zend-vm=CALL'
'--prefix=/
usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/'
'--build=i386-
portbld-freebsd6.3'
Server API => Command Line Interface
Virtual Directory Support => disabled
Configuration File (php.ini) Path => /usr/local/etc
Loaded Configuration File => /usr/local/etc/php.ini
Scan this dir for additional .ini files => /usr/local/etc/php
additional .ini files parsed => /usr/local/etc/php/extensions.ini

PHP API => 20041225
PHP Extension => 20060613
Zend Extension => 220060519
Debug Build => no



Test script:
---------------
function myhash($key) {
        $h = 5381;
        $l = strlen($key);
        for($i = 0; $i < $l; ++$i) {
            $h = (($h << 5) + $h) ^ ord($key[$i]);
        }
        return $h;
}
$h = myhash('CL6.1.7');
if ($h != 754303898)
        echo "bug\n";
echo $h . "\n";


Expected result:
----------------
754303898


Actual result:
--------------
bug
-2147483593


------------------------------------------------------------------------



-- 
Edit this bug report at http://bugs.php.net/bug.php?id=51397&edit=1


Thread (6 messages)

« previous php.bugs (#151200) next »