Bug #71197 [NEW]: 2 more segfaults in PHP's range() function
From: tpunt
Operating system: Mac OS X Yosemite
PHP version: 7.0.1
Package: Reproducible crash
Bug Type: Bug
Bug description:2 more segfaults in PHP's range() function
Description:
------------
The segfaults are caused by precision loss of large longs being
converted to doubles when the step parameter is a double. The for
loops continue infinitely since the step being added/subtracted upon
each iteration is too small to be represented accurately as a double.
The attached patch adds another condition to each of the for loops by
ensuring that the number of iterations in the loop are less than the
size of the range (__calc_size). This prevents both loops from
continuing until segfaulting, however doesn't give an accurate result
(due to __calc_size being incorrect because of aforementioned
precision loss).
Test script:
---------------
var_dump(count(range(PHP_INT_MIN, PHP_INT_MIN + 513, .01)));
var_dump(count(range(PHP_INT_MIN + 513, PHP_INT_MIN, .01)));
Expected result:
----------------
// A completely correct output would be:
int(51400)
int(51400)
Actual result:
--------------
Segmentation fault: 11
Segmentation fault: 11
--
Edit bug report at https://bugs.php.net/bug.php?id=71197&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71197&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71197&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71197&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=71197&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=71197&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=71197&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=71197&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=71197&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=71197&r=support
Expected behavior: https://bugs.php.net/fix.php?id=71197&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=71197&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=71197&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=71197&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71197&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=71197&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=71197&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=71197&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71197&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=71197&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=71197&r=mysqlcfg
Thread (3 messages)
- tpunt@php.net