[php-src] Issue #11177: ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client

From: Date: Tue, 02 May 2023 13:08:35 +0000
Subject: [php-src] Issue #11177: ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-244341@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/11177
Author: lucasnetau

### Description

The following code with ASAN enabled:

```php
<?php
$socket = stream_socket_server("tcp://0.0.0.0:8080", $errno, $errstr);
$conn = stream_socket_accept($socket, -1);
fclose($conn);
fclose($socket);
```

Resulted in this output:
```
/php-debug/php-8.2.5/ext/standard/streamsfuncs.c:278:9: runtime error: -1e+06 is outside the range
of representable values of type 'unsigned long long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
/php-debug/php-8.2.5/ext/standard/streamsfuncs.c:278:9 in 
Abort trap: 6
```

But I expected this output instead:
```
```

With the offending line being in stream_socket_accept modifying the timeout value and assigning a
negative value to an unsigned long long (php_timeout_ull)

```
	/* prepare the timeout value for use */
	conv = (php_timeout_ull) (timeout * 1000000.0);
```

The same code and ASAN error can also be seen in stream_socket_client


### PHP Version

PHP 8.2.5

### Operating System

_No response_


Thread (1 message)

  • lucasnetau
« previous php.bugs (#244341) next »