Bug #76532 [Opn->Ver]: Integer overflow and excessive memory usage in mb_strimwidth

Edit report at https://bugs.php.net/bug.php?id=76532&edit=1 ID: 76532 Updated by: cmb@php.net Reported by: l-x+php at mailbox dot org Summary: Integer overflow and excessive memory usage in mb_strimwidth -Status: Open +Status: Verified Type: Bug Package: mbstring related Operating System: 4.17.0-gentoo PHP Version: 7.2.7 Block user comment: N Private report: N New Comment: The integer overflow happens because width is a zend_long, but is converted to int when mbfl_strimwidth is called[1]. PHP 7.3 shouldn't have this issue, since mbfl_strimwidth expects a size_t now[2]. [1] <https://github.com/php/php-src/blob/php-7.2.7/ext/mbstring/mbstring.c#L3151> [2] <https://github.com/php/php-src/blob/php-7.3.0alpha2/ext/mbstring/libmbfl/mbfl/mbfilter.c#L1677> Previous Comments: ------------------------------------------------------------------------ [2018-06-26 11:35:35] l-x+php at mailbox dot org Description: ------------ mb_strimwidth returns an empty string for $width > 2147483647 mb_strimwidth requires memory greater than $width - 2GB for the provided test script Affected versions (as far as I can test): - PHP 5.6.36-pl0-gentoo (cli and fpm) - PHP 7.2.6 (cli and fpm) Test script: --------------- <?php declare(strict_types=1); function doIt(int $width): void { $string_to_trim = 'some test string'; $expected_result = $string_to_trim; $actual_result = mb_strimwidth($string_to_trim, 0, $width); echo <<<RESULT Width: $width String to trim: $string_to_trim Expected result: $expected_result Acutal result: $actual_result RESULT; } $width = 2147483647; doIt($width); doIt($width + 1); echo memory_get_peak_usage(true); Expected result: ---------------- Width: 2147483647 String to trim: some test string Expected result: some test string Acutal result: some test string Width: 2147483648 String to trim: some test string Expected result: some test string Acutal result: some test string 2149580800 Actual result: -------------- Width: 2147483647 String to trim: some test string Expected result: some test string Acutal result: some test string Width: 2147483648 String to trim: some test string Expected result: some test string Acutal result: 2149580800 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76532&edit=1