Bug #52899 [Csd->Dup]: Incorrect array key cast (string to integer) when key > PHP_INT_MAX

Edit report at http://bugs.php.net/bug.php?id=52899&edit=1 ID: 52899 Updated by: cataphract@php.net Reported by: thorn at slonik dot sk Summary: Incorrect array key cast (string to integer) when key > PHP_INT_MAX -Status: Closed +Status: Duplicate Type: Bug Package: Scripting Engine problem Operating System: Linux 32-bit PHP Version: 5.2.14 Block user comment: N New Comment: The relevant code is here: http://lxr.php.net/xref/PHP_TRUNK/Zend/zend_hash.h#ZEND_HANDLE_NUMERIC_EX It's not the most beautiful thing and it actually relies on undefined behavior, namely that an integer overflow will result in a wrap-around (signed integer overflow has undefined behavior as per the C standard). It relies on getting a negative number to detect the overflow. However, it explicitly tests for the sign of the result, so it would appear it could never allow a negative number without the string starting with "-". But apparently, that check is optimized away, depending on compiler flags. Duplicate of bug #51008. The Debian patch is probably the way to go. Previous Comments: ------------------------------------------------------------------------ [2010-09-24 09:09:34] thorn at slonik dot sk Since you cannot reproduce it and I don't have access to other 32-bit machine with linux & php I close this bug. I'd conclude with: It seems to be gentoo specific bug. Even though they could not help as of yet. :( ------------------------------------------------------------------------ [2010-09-22 13:28:05] thorn at slonik dot sk I tried 5.3.3 but the results are same as with 5.2.14. ------------------------------------------------------------------------ [2010-09-22 09:08:58] thorn at slonik dot sk I opened a gentoo bug: http://bugs.gentoo.org/show_bug.cgi?id=338280 I tried my test script on same machine with windows and it works correctly. I'm compiling 5.3.3 now to see if it's any different. Will post results later. ------------------------------------------------------------------------ [2010-09-21 17:41:42] cataphract@php.net Can you try with a vanilla version of PHP 5.2.14? By inspection, I don't see how this can happen. Most likely it's due to a Gentoo patch. ------------------------------------------------------------------------ [2010-09-21 15:54:45] thorn at slonik dot sk I'm using gentoo linux (no distro binaries) $ php -v PHP 5.2.14-pl0-gentoo (cli) (built: Sep 17 2010 12:47:23) Copyright (c) 1997-2010 The PHP Group Zend Engine v2.2.0, Copyright (c) 1998-2010 Zend Technologies $ uname -a Linux gloriosa 2.6.35-tuxonice-r1 #1 SMP Wed Sep 1 08:59:13 CEST 2010 i686 Intel(R) Pentium(R) 4 CPU 2.80GHz GenuineIntel GNU/Linux ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at http://bugs.php.net/bug.php?id=52899 -- Edit this bug report at http://bugs.php.net/bug.php?id=52899&edit=1