Bug #75208 [NEW]: signed integer overflow in zend_strtod (Zend/zend_strtod.c)

From: geeknik at protonmail dot ch Operating system: Debian 8 x64 PHP version: 7.2Git-2017-09-14 (Git) Package: Reproducible crash Bug Type: Bug Bug description:signed integer overflow in zend_strtod (Zend/zend_strtod.c) Description: ------------ Undefined behavior in zend_strtod() triggered while fuzzing 0ee92ae. Test script: --------------- php -r 'var_dump(json_decode('0E2400000000'));' Actual result: -------------- /root/php-src/Zend/zend_strtod.c:2708:12: runtime error: signed integer overflow: 10 * 240000000 cannot be represented in type 'int' #0 0x165763b in zend_strtod /root/php-src/Zend/zend_strtod.c:2708:12 #1 0x146c741 in lex_scan /root/php-src/Zend/zend_language_scanner.l:1742:2 #2 0x14ca10a in zendlex /root/php-src/Zend/zend_compile.c:1721:11 #3 0x143e16b in zendparse /root/php-src/Zend/zend_language_parser.c:4227:16 #4 0x144dbb2 in zend_compile /root/php-src/Zend/zend_language_scanner.l:585:7 #5 0x145010c in compile_string /root/php-src/Zend/zend_language_scanner.l:767:14 #6 0x154c4d3 in zend_eval_stringl /root/php-src/Zend/zend_execute_API.c:1068:17 #7 0x154d12b in zend_eval_stringl_ex /root/php-src/Zend/zend_execute_API.c:1121:11 #8 0x154d12b in zend_eval_string_ex /root/php-src/Zend/zend_execute_API.c:1132 #9 0x1a28558 in do_cli /root/php-src/sapi/cli/php_cli.c:1042:8 #10 0x1a26227 in main /root/php-src/sapi/cli/php_cli.c:1404:18 #11 0x7f686738eb44 in __libc_start_main /build/glibc-6V9RKT/glibc-2.19/csu/libc-start.c:287 #12 0x44159b in _start (/root/php-src/sapi/cli/php+0x44159b) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /root/php-src/Zend/zend_strtod.c:2708:12 -- Edit bug report at https://bugs.php.net/bug.php?id=75208&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=75208&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=75208&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=75208&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=75208&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=75208&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=75208&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=75208&r=needscript Try newer version: https://bugs.php.net/fix.php?id=75208&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=75208&r=support Expected behavior: https://bugs.php.net/fix.php?id=75208&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=75208&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=75208&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=75208&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=75208&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=75208&r=dst IIS Stability: https://bugs.php.net/fix.php?id=75208&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=75208&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=75208&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=75208&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=75208&r=mysqlcfg