Bug #68664 [Nab]: out of bounds write / invalid operation

Edit report at https://bugs.php.net/bug.php?id=68664&edit=1 ID: 68664 User updated by: honey at internot dot info Reported by: honey at internot dot info Summary: out of bounds write / invalid operation Status: Not a bug Type: Bug Package: *General Issues Operating System: Linux Ubuntu 14.04 PHP Version: master-Git-2014-12-28 (Git) Block user comment: N Private report: N New Comment: Hi, The real question/problem I had with this was the semicolon used with the "while" loop. I've never seen a statement like that. Is it correct? I actually realized this wasn't a sec. bug earlier today, and I thought I had responded, but I must have forgotton to put the password, so my reply didn't go through. Thanks, Previous Comments: ------------------------------------------------------------------------ [2014-12-30 08:18:43] stas@php.net while() is part of do/while construct, so it can not be "> 0) {". In theory, it can happen that i goes down to 0, in practice due to NUM_BUF_SIZE being 500, i starts with 499, which means magn should be at least 10^500 for this to happen, or occupy about 1661 bits. Since magn is defined as long and no known system where PHP runs has longs of this size, this does not seem to be a real issue. We could probably change the condition to i > 1 just to be nicer but I see no real issue there. ------------------------------------------------------------------------ [2014-12-28 03:44:58] honey at internot dot info Description: ------------ Hi, In /ext/standard/formatted_print.c: 158 while (magn > 0 && i > 0); Should it be "> 0) {"? 158 while (magn > 0 && i > 0); 159 if (neg) { 160 numbuf[--i] = '-'; Thanks, ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=68664&edit=1