Bug #52550 [Com]: integer undefined behaviors executed during "make test"

Edit report at https://bugs.php.net/bug.php?id=52550&edit=1 ID: 52550 Comment by: regehr at cs dot utah dot edu Reported by: regehr at cs dot utah dot edu Summary: integer undefined behaviors executed during "make test" Status: Feedback Type: Bug Package: *General Issues Operating System: linux PHP Version: master Block user comment: N Private report: N New Comment: See below. I got this by using "clang -fsanitize=undefined" to compile today's PHP from git, then running "make test". These kinds of problems are generally pretty easy to debug by putting an assertion in front of each offending line of code. Zend/zend_execute_API.c:146:46: runtime error: index -1 out of bounds for type 'HashTable *[32]' Zend/zend_execute_API.c:146:46: runtime error: index -1 out of bounds for type 'HashTable *[32]' Zend/zend_operators.c:1287:2: runtime error: shift exponent 65 is too large for 64-bit type 'long' Zend/zend_operators.c:1307:2: runtime error: shift exponent -1 is negative Zend/zend_operators.c:1307:2: runtime error: shift exponent 65 is too large for 64-bit type 'long' Zend/zend_operators.h:108: runtime error: value nan is outside the range of representable values of type 'long' ext/date/lib/parse_tz.c:135:35: runtime error: signed integer overflow: 255 * 16777216 cannot be represented in type 'int' ext/phar/zip.c:150:34: runtime error: left shift of negative value -11 ext/sqlite3/libsqlite/sqlite3.c:57012:22: runtime error: member access within null pointer of type 'Mem' (aka 'struct Mem') ext/standard/crypt_freesec.c:632:15: runtime error: left shift of negative value -61 ext/standard/math.c:148:24: runtime error: signed integer overflow: 14 - -2147483648 cannot be represented in type 'int' ext/standard/math.c:41: runtime error: value -inf is outside the range of representable values of type 'int' ext/standard/string.c:1671: runtime error: value 1.01235e+11 is outside the range of representable values of type 'int' ext/standard/string.c:1671: runtime error: value 1.05e+11 is outside the range of representable values of type 'int' ext/standard/url_scanner_ex.re:414:57: runtime error: member access within null pointer of type 'url_adapt_state_ex_t' Previous Comments: ------------------------------------------------------------------------ [2013-12-05 19:55:36] regehr at cs dot utah dot edu Sure I'll do this tonight. ------------------------------------------------------------------------ [2013-12-05 19:49:43] mike@php.net Any chance on getting an updated report or some automatic report? ------------------------------------------------------------------------ [2012-06-21 04:35:20] regehr at cs dot utah dot edu Also, our integer overflow checking tool can now be grabbed here: http://embed.cs.utah.edu/ioc/ ------------------------------------------------------------------------ [2012-06-21 04:30:33] regehr at cs dot utah dot edu Updated results from today's PHP. ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/ext/date/lib/parse_tz.c, (135:35)> : Op: *, Reason : Signed Multiplication Overflow, BINARY OPERATION: left (int32): 255 right (int32): 16777216 ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/ext/standard/math.c, (148:24)> : Op: -, Reason : Signed Subtraction Overflow, BINARY OPERATION: left (int32): 14 right (int32): -2147483648 ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_hash.h, (350:2)> : Op: -, Reason : Signed Subtraction Overflow, UNARY OPERATION: left (int64): 0 right (int64): -9223372036854775808 ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_operators.c, (1178:2)> : Op: <<, Reason : Signed Left Shift: Right operand is negative or is greater than or equal to the width of the promoted left operand, BINARY OPERATION: left (int64): 0 right (int64): 65 ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_operators.c, (1178:2)> : Op: <<, Reason : Signed Left Shift: Right operand is negative or is greater than or equal to the width of the promoted left operand, BINARY OPERATION: left (int64): 9223372036854775807 right (int64): -1 ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_operators.c, (1191:2)> : Op: >>, Reason : Signed Right Shift: Right operand is negative or is greater than or equal to the width of the promoted left operand, BINARY OPERATION: left (int64): 0 right (int64): 65 ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_operators.c, (1191:2)> : Op: >>, Reason : Signed Right Shift: Right operand is negative or is greater than or equal to the width of the promoted left operand, BINARY OPERATION: left (int64): 9223372036854775807 right (int64): -1 ------------------------------------------------------------------------ [2011-06-12 02:56:20] cataphract@php.net Automatic comment from SVN on behalf of cataphract Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=312074 Log: - Reverted r301991, which is a (partial) fix to bug #52550, addressing an overflow in a signed subtraction. This fixes the overflow without changing the algorithm. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=52550 -- Edit this bug report at https://bugs.php.net/bug.php?id=52550&edit=1