Bug #78454 [Com]: Multiple consecutive numeric separators in bin/hex numbers cause fatal error

Edit report at https://bugs.php.net/bug.php?id=78454&edit=1 ID: 78454 Comment by: theodorejb at outlook dot com Reported by: mattacosta at gmail dot com Summary: Multiple consecutive numeric separators in bin/hex numbers cause fatal error Status: Analyzed Type: Bug Package: Scripting Engine problem PHP Version: 7.4.0beta4 Block user comment: N Private report: N New Comment: Is something wrong with the re2c regex? It seems strange that the BNUM/HNUM code even runs when there are invalid characters in the literal. Do we have to duplicate syntax checks in the BNUM/HNUM code? Previous Comments: ------------------------------------------------------------------------ [2019-08-24 22:55:49] requinix@php.net > Fatal error: Possible integer overflow in memory allocation (0 + 32) 1. Multiple consecutive underscores are not supposed to be allowed 2. Parser is matching HNUM as only the "0x0" 3. HNUM code skips *all* leading zeros and underscores, goes beyond "0x0" length assumed, len underflows ------------------------------------------------------------------------ [2019-08-24 22:05:13] mattacosta at gmail dot com Description: ------------ Multiple adjacent underscores after a leading 0 in a hex or bin number cause a fatal error. https://3v4l.org/jUR51 Test script: --------------- 0x0__F; // or 0b0__1; Expected result: ---------------- Parse error: syntax error, unexpected '__F' (T_STRING) Actual result: -------------- Fatal error: Out of memory (allocated 2097152) (tried to allocate 18446744073709551615 bytes) in /in/jUR51 on line 3 mmap() failed: [22] Invalid argument mmap() failed: [22] Invalid argument Process exited with code 255. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78454&edit=1