Edit report at https://bugs.php.net/bug.php?id=62477&edit=1
ID: 62477
Updated by: nikic@php.net
Reported by: tuadmin at gmail dot com
Summary: Problem LimitIterator , argument Offset only
Integers
-Status: Assigned
+Status: Closed
Type: Bug
Package: SPL related
Operating System: Any x86
PHP Version: 5.6.24
Assigned To: ab
Block user comment: N
Private report: N
New Comment:
Closing this per my previous comment. The issue is fixed to the degree it can be fixed in PHP 7.
Previous Comments:
------------------------------------------------------------------------
[2016-08-02 09:56:08] nikic@php.net
@requinix: I'd assume it was reverted because it's an ABI break. spl_iterators.h is an
exported header. We cannot change the structure in 5.6.
As far as I understand, PHP 7 fixes both a) use of int in LimitIterator, instead using zend_long and
allowing 63-bit ranges on reasonable systems and b) no longer silently accepts truncating float to
integer overflows during parameter parsing.
As such, I'd consider this issue resolved, as we cannot apply these changes in 5.6.
------------------------------------------------------------------------
[2016-08-02 02:24:05] requinix@php.net
32-bit PHP 5.6 on Windows has the same problem as originally reported, however I don't think
that's a bug: as implied in the first comment, LimitIterator accepts "int" so the
10e9 float will overflow (twice) to 1410065408. Changing to use floats/doubles could be a request
but it doesn't sound like a good one.
Testing with 3v4l did show something odd: 64-bit 5.6 has a problem applying the $count=3 condition.
<https://3v4l.org/mCQBW#v560> PHP 7 has current.pos,
limit.offset, and limit.count as all zend_longs but 5.6.24 still has them as int,long,long
respectively. Promoting current.pos to long should fix it but that commit (b383ddf) was reverted
(ad7eeba)?
https://github.com/php/php-src/commit/b383ddf1e5175abf1d000e887961fdcebae646a0https://github.com/php/php-src/commit/ad7eeba3c1a4c77f439afc936fbf50b811a46a6b
------------------------------------------------------------------------
[2016-08-02 01:09:10] tuadmin at gmail dot com
bug not resolved
------------------------------------------------------------------------
[2016-08-02 01:06:21] tuadmin at gmail dot com
Not Fixed
------------------------------------------------------------------------
[2014-10-07 23:34:50] stas@php.net
Automatic comment on behalf of ab
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=b383ddf1e5175abf1d000e887961fdcebae646a0
Log: Fixed bug #62477 LimitIterator int overflow
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=62477
--
Edit this bug report at https://bugs.php.net/bug.php?id=62477&edit=1