[php-src] Issue #18758: Potential integer underflow in `format_converter()` when `precision < 0` and `adjust_precision == true`
| From: | PavlNekrasov | Date: | Wed, 04 Jun 2025 11:51:44 +0000 |
| Subject: | [php-src] Issue #18758: Potential integer underflow in `format_converter()` when `precision < 0` and `adjust_precision == true` | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-250202@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/18758
Author: PavlNekrasov
### Description
Hi,
In the following code, possible
precision variable value being set to -1
and adjust_precision == true:
https://github.com/php/php-src/blob/3a14ce19a5363f51300315e786ec32258bab6449/main/snprintf.c#L576-L586
This can result undefined behavior when precision is later cast to size_t.
https://github.com/php/php-src/blob/3a14ce19a5363f51300315e786ec32258bab6449/main/snprintf.c#L845
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Reporter: Pavel Nekrasov ([p.nekrasov@fobos-nt.ru](mailto:p.nekrasov@fobos-nt.ru)).
Organization: Fobos-NT ([info@fobos-nt.ru](mailto:info@fobos-nt.ru)).
### PHP Version
```plain
PHP 8.3
```
### Operating System
Alt p10