Bug #76532 [NEW]: Integer overflow and excessive memory usage in mb_strimwidth

From: l-x+php at mailbox dot org Operating system: 4.17.0-gentoo PHP version: 7.2.7 Package: mbstring related Bug Type: Bug Bug description:Integer overflow and excessive memory usage in mb_strimwidth Description: ------------ mb_strimwidth returns an empty string for $width > 2147483647 mb_strimwidth requires memory greater than $width - 2GB for the provided test script Affected versions (as far as I can test): - PHP 5.6.36-pl0-gentoo (cli and fpm) - PHP 7.2.6 (cli and fpm) Test script: --------------- <?php declare(strict_types=1); function doIt(int $width): void { $string_to_trim = 'some test string'; $expected_result = $string_to_trim; $actual_result = mb_strimwidth($string_to_trim, 0, $width); echo <<<RESULT Width: $width String to trim: $string_to_trim Expected result: $expected_result Acutal result: $actual_result RESULT; } $width = 2147483647; doIt($width); doIt($width + 1); echo memory_get_peak_usage(true); Expected result: ---------------- Width: 2147483647 String to trim: some test string Expected result: some test string Acutal result: some test string Width: 2147483648 String to trim: some test string Expected result: some test string Acutal result: some test string 2149580800 Actual result: -------------- Width: 2147483647 String to trim: some test string Expected result: some test string Acutal result: some test string Width: 2147483648 String to trim: some test string Expected result: some test string Acutal result: 2149580800 -- Edit bug report at https://bugs.php.net/bug.php?id=76532&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=76532&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=76532&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=76532&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=76532&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=76532&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=76532&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=76532&r=needscript Try newer version: https://bugs.php.net/fix.php?id=76532&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=76532&r=support Expected behavior: https://bugs.php.net/fix.php?id=76532&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=76532&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=76532&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=76532&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=76532&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=76532&r=dst IIS Stability: https://bugs.php.net/fix.php?id=76532&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=76532&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=76532&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=76532&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=76532&r=mysqlcfg