[php-src] Issue #15552: Signed integer overflow in ext/standard/scanf.c
| From: | YuanchengJiang | Date: | Fri, 23 Aug 2024 06:49:34 +0000 |
| Subject: | [php-src] Issue #15552: Signed integer overflow in ext/standard/scanf.c | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-247578@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/15552
Author: YuanchengJiang
### Description
The following code:
```php
<?php
try {
sprintf('%2147483648$s, %2$s %1$s', "a", "b");
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
sscanf($e,$e,$e);
?>
```
Resulted in this output:
```
/php-src/ext/standard/scanf.c:364:21: runtime error: signed integer overflow: -2147483648 - 1 cannot
be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/standard/scanf.c:364:21
```
### PHP Version
PHP 8.4.0-dev
### Operating System
ubuntu 22.04