Bug #66183 [Opn->Csd]: Converting large strings to floats

Edit report at https://bugs.php.net/bug.php?id=66183&edit=1 ID: 66183 Updated by: nikic@php.net Reported by: aatallah at stanford dot edu Summary: Converting large strings to floats -Status: Open +Status: Closed Type: Bug Package: Strings related Operating System: Mac OS X 10.9 PHP Version: Irrelevant -Assigned To: +Assigned To: nikic Block user comment: N Private report: N CVE-ID: 2013-4164 New Comment: This has been fixed in PHP 7 as part of the strtod update. Previous Comments: ------------------------------------------------------------------------ [2013-12-12 05:29:59] laruence@php.net hmm, misunderstood, this is not a security bug for php ------------------------------------------------------------------------ [2013-11-27 14:17:42] aatallah at stanford dot edu Description: ------------ I'm using PHP 5.4.17 (cli) (built: Aug 25 2013 02:03:38), the default shipped by Apple now. See the test script. When a string-representation of a decimal is large enough, converting it to a float causes "Fatal error: Balloc() allocation exceeds list boundary in php shell code on line 1" and terminates the script. This is similar to Ruby's bug, publicized at https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/. Ruby fixed this by avoiding the Bigint freelist in Balloc; perhaps PHP should do something better than having a hard cutoff for k in Balloc. Test script: --------------- echo floatval("1.".str_repeat("1", 300000)); Expected result: ---------------- 1.1111111111111, which is the output of echo floatval("1.".str_repeat("1", 300)); Actual result: -------------- Fatal error: Balloc() allocation exceeds list boundary in php shell code on line 1 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66183&edit=1