Bug #69702 [NEW]: Handle pool integer overflow
From: info at daniel-marschall dot de
Operating system: Linux 3.2.0-4-amd64 #1 SMP Debia
PHP version: 5.4.41
Package: *General Issues
Bug Type: Bug
Bug description:Handle pool integer overflow
Description:
------------
Given is following CLI script, which will do a "for" loop for
BigIntegers (gmp). I iterate $i from 0 to 999999999999999999 .
I see 4 problems:
1) There is no possibility to increase a GMP number without re-creating
it using gmp_add() .
2) On a 64-bit OS, the max handle pool is still an unsigned 32 bit int
(see below)???
3) The handle pool counter does not reset when variables are freed,
therefore an integer overflow happens.
4) there is no possibility to free a gmp resource. I assume that it is
done automatically, since there is no gmp_free().
Test script:
---------------
#!/usr/bin/php
<?php
$max = gmp_init("999999999999999999");
$i = gmp_init(0);
while ((gmp_cmp($i, $max) == -1)) {
$i = gmp_add($i, 1);
}
Expected result:
----------------
Since $i is re-assigned (and the old instance of the gmp-object is freed
therefore), there should be neither a memory overflow, nor anything else
failing.
Actual result:
--------------
[after a very long waiting time, of course!]
PHP Warning: gmp_cmp(): -2147483648 is not a valid GMP integer resource
in .../phpbug.php on line 7
PHP Stack trace:
PHP 1. {main}() .../phpbug.php:0
PHP 2. gmp_cmp() .../phpbug.php:7
Warning: gmp_cmp(): -2147483648 is not a valid GMP integer resource in
.../phpbug.php on line 7
Call Stack:
0.0001 226000 1. {main}() .../phpbug.php:0
4309.1840 227048 2. gmp_cmp() .../phpbug.php:7
--
Edit bug report at https://bugs.php.net/bug.php?id=69702&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=69702&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=69702&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=69702&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=69702&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=69702&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=69702&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=69702&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=69702&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=69702&r=support
Expected behavior: https://bugs.php.net/fix.php?id=69702&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=69702&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=69702&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=69702&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=69702&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=69702&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=69702&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=69702&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=69702&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=69702&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=69702&r=mysqlcfg
Thread (3 messages)
- info at daniel-marschall dot de