Bug #62477 [Wfx->Csd]: Problem LimitIterator , argument Offset only Integers

Edit report at https://bugs.php.net/bug.php?id=62477&edit=1 ID: 62477 Updated by: stas@php.net Reported by: tuadmin at gmail dot com Summary: Problem LimitIterator , argument Offset only Integers -Status: Wont fix +Status: Closed Type: Bug Package: SPL related Operating System: windows XP SP3 PHP Version: 5.3.14 Assigned To: ab Block user comment: N Private report: N New Comment: Automatic comment on behalf of ab Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=b383ddf1e5175abf1d000e887961fdcebae646a0 Log: Fixed bug #62477 LimitIterator int overflow Previous Comments: ------------------------------------------------------------------------ [2012-07-12 10:48:23] ab@php.net the fix was reverted ------------------------------------------------------------------------ [2012-07-11 20:41:46] ab@php.net This bug has been fixed in SVN. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. For Windows: http://windows.php.net/snapshots/ Thank you for the report, and for helping us make PHP better. ------------------------------------------------------------------------ [2012-07-11 20:39:58] ab@php.net Automatic comment on behalf of ab Revision: http://git.php.net/?p=php-src.git;a=commit;h=b383ddf1e5175abf1d000e887961fdcebae646a0 Log: Fixed bug #62477 LimitIterator int overflow ------------------------------------------------------------------------ [2012-07-11 17:24:23] ab@php.net If you look at this signature http://lxr.php.net/xref/PHP_5_4/ext/spl/spl_iterators.c#2433 - the pos is of type long. Of course passing a value from the double range here causes overflows. But the thing is even worse if you look here http://lxr.php.net/xref/PHP_5_4/ext/spl/spl_iterators.h#126 as ->current.pos element is of type int. So for one there is an overflow with double/int, and for another - an overflow long/int. I think therefore you'll be getting strange effects also if you push enough elements into an iterator. All this might need a more complex solution, for now it might be at least catched checking the index range and throwing an exception. ------------------------------------------------------------------------ [2012-07-04 04:41:45] tuadmin at gmail dot com Description: ------------ --- From manual page: http://www.php.net/class.limititerator --- The LimitIterator error is given by the offset argument as INTEGER and not only allows FLOATS --spanish-- El error de limitIterator es dado por el argumento de OFFSET ya que solo permite ENTEROS y no FLOATS Test script: --------------- /** * @author tuadmin * @version 1.0.0 */ class combinator implements SeekableIterator { private $_n = 0;//float val public function next(){$this->_n++;} public function rewind(){$this->_n = 0;} public function current(){ return $this->_n;} public function key(){} public function valid(){return $this->_n < 10000000000000000000;} public function seek($pos){$this->_n = $pos;} } $comb = new combinator();$float = 10000000000; echo "-------------incorrect limit Iterator float seek----------\n"; foreach(new limitIterator($comb,$float,3) as $current){ echo $current."\n";} echo "-------------correct----------\n"; for($comb->seek($float) ; $comb->current() < $float+3 && $comb->valid();$comb->next()){ echo $comb->current()."\n";} Expected result: ---------------- -------------incorrect limit Iterator float seek---------- 10000000000 10000000001 10000000002 -------------correct---------- 10000000000 10000000001 10000000002 Actual result: -------------- -------------incorrect limit Iterator float seek---------- 1410065408 1410065409 1410065410 -------------correct---------- 10000000000 10000000001 10000000002 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=62477&edit=1