Bug #72536 [NEW]: gmp_random_bits / gmp_random abort reached

From: fernando at null-life dot com Operating system: Windows PHP version: 7.0.8 Package: GNU MP related Bug Type: Bug Bug description:gmp_random_bits / gmp_random abort reached Description: ------------ void * __gmp_default_reallocate (void *oldptr, size_t old_size, size_t new_size) { void *ret; #ifdef DEBUG size_t req_size = new_size; if (old_size != 0) { mp_ptr p = oldptr; if (p[-1] != (0xdeadbeef << 31) + 0xdeafdeed) { fprintf (stderr, "gmp: (realloc) data clobbered before allocation block\n"); abort (); } if (old_size % BYTES_PER_MP_LIMB == 0) if (p[old_size / BYTES_PER_MP_LIMB] != ~((0xdeadbeef << 31) + 0xdeafdeed)) { fprintf (stderr, "gmp: (realloc) data clobbered after allocation block\n"); abort (); } oldptr = p - 1; } new_size += 2 * BYTES_PER_MP_LIMB; #endif ret = realloc (oldptr, new_size); if (ret == 0) { #if defined _MSC_VER && defined _WIN64 fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%llu new_size=%llu)\n", old_size, new_size); #else fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%lu new_size=%lu)\n", old_size, new_size); #endif abort (); } This abort inside __gmp_default_reallocate is reached with the attached test scripts. Maybe a check can be implemented inside php-gmp extension to prevent it. Tested on 64 bits Windows. Test script: --------------- <?php $v1=-4500000000; echo gmp_random($v1); <?php $v1=PHP_INT_MAX; gmp_random_bits($v1); Expected result: ---------------- No crash Actual result: -------------- php.exe crashes -- Edit bug report at https://bugs.php.net/bug.php?id=72536&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=72536&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=72536&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=72536&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=72536&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=72536&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=72536&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=72536&r=needscript Try newer version: https://bugs.php.net/fix.php?id=72536&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=72536&r=support Expected behavior: https://bugs.php.net/fix.php?id=72536&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=72536&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=72536&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=72536&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=72536&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=72536&r=dst IIS Stability: https://bugs.php.net/fix.php?id=72536&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=72536&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=72536&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=72536&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=72536&r=mysqlcfg