Bug #71507 [NEW]: Overflow in php_tvtoto

From: martijn at hexon dot cx Operating system: PHP version: 5.6.17 Package: Network related Bug Type: Bug Bug description:Overflow in php_tvtoto Description: ------------ php_tvtoto() in main/php_network.h converts a struct timeval to a timeout in seconds. In some cases php_tvtoto() is called with a large value for tv_sec, causing the resulting integer to overflow. For example with mysqlnd, where the default value for mysqlnd.net_read_timeout is 31536000 (one year, in seconds) poll([{fd=13, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=13, revents=POLLIN}]) #0 0x00007f47000bbe88 in poll () from /lib64/libc.so.6 #1 0x0000000000801399 in php_pollfd_for (stream=<value optimized out>, buf=<value optimized out>, count=<value optimized out>) at /usr/src/php-5.6.17/main/php_network.h:165 #2 php_sockop_write (stream=<value optimized out>, buf=<value optimized out>, count=<value optimized out>) at /usr/src/php-5.6.17/main/streams/xp_socket.c:82 #3 0x000000000047fee0 in php_openssl_sockop_io (read=0, stream=<value optimized out>, buf=<value optimized out>, count=18446744073709551615) at /usr/src/php-5.6.17/ext/openssl/xp_ssl.c:1971 #4 0x00000000007f4457 in _php_stream_write_buffer (stream=0xeadb090, buf=0x148d0780 "e-querylarge-querylarge-querylarge-querylarge-"..., count=25467) at /usr/src/php-5.6.17/main/streams/streams.c:1133 #5 0x00000000007c9eec in php_mysqlnd_net_send_ex_pub (net=0x105bb7e0, buffer=0x148cb2a8 "O\270", count=<value optimized out>, conn_stats=<value optimized out>, error_info=<value optimized out>) at /usr/src/php-5.6.17/ext/mysqlnd/mysqlnd_net.c:447 ... 31536000 * 1000 mod 2^32 = 1471228928 So poll times out after ~17 days instead of 365 days. Test script: --------------- test.php: <?php $db = new mysqli(...); // Prepare large query to fill the output buffer causing mysqlnd // to call php_pollfd_for() $largeSQL = 'SELECT "'. str_repeat('large-query', 1000000) .'"'; $db->query($largeSQL); ?> strace test.php Expected result: ---------------- poll([{fd=4, events=POLLOUT}], 1, 4294967296) = 1 ([{fd=4, revents=POLLOUT}]) (or maybe a timeout of -1 is better) Actual result: -------------- poll([{fd=4, events=POLLOUT}], 1, 1471228928) = 1 ([{fd=4, revents=POLLOUT}]) -- Edit bug report at https://bugs.php.net/bug.php?id=71507&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=71507&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=71507&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=71507&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=71507&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=71507&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=71507&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=71507&r=needscript Try newer version: https://bugs.php.net/fix.php?id=71507&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=71507&r=support Expected behavior: https://bugs.php.net/fix.php?id=71507&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=71507&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=71507&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=71507&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71507&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=71507&r=dst IIS Stability: https://bugs.php.net/fix.php?id=71507&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=71507&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=71507&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=71507&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=71507&r=mysqlcfg