Sec Bug->Bug #68664 [Opn->Nab]: out of bounds write / invalid operation

Edit report at https://bugs.php.net/bug.php?id=68664&edit=1 ID: 68664 Updated by: stas@php.net Reported by: honey at internot dot info Summary: out of bounds write / invalid operation -Status: Open +Status: Not a bug -Type: Security +Type: Bug Package: *General Issues Operating System: Linux Ubuntu 14.04 PHP Version: master-Git-2014-12-28 (Git) Block user comment: N Private report: Y New Comment: while() is part of do/while construct, so it can not be "> 0) {". In theory, it can happen that i goes down to 0, in practice due to NUM_BUF_SIZE being 500, i starts with 499, which means magn should be at least 10^500 for this to happen, or occupy about 1661 bits. Since magn is defined as long and no known system where PHP runs has longs of this size, this does not seem to be a real issue. We could probably change the condition to i > 1 just to be nicer but I see no real issue there. Previous Comments: ------------------------------------------------------------------------ [2014-12-28 03:44:58] honey at internot dot info Description: ------------ Hi, In /ext/standard/formatted_print.c: 158 while (magn > 0 && i > 0); Should it be "> 0) {"? 158 while (magn > 0 && i > 0); 159 if (neg) { 160 numbuf[--i] = '-'; Thanks, ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68664&edit=1