[php-src] Issue #18841: Potential overflow and sign-extension issues in posix_times() when converting clock_t to zend_long

From: Date: Thu, 12 Jun 2025 16:36:07 +0000
Subject: [php-src] Issue #18841: Potential overflow and sign-extension issues in posix_times() when converting clock_t to zend_long
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-250252@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/18841 Author: DehartShow ### Description There is a potential security issue when converting clock_t to zend_long that could lead to unpredictable results on different platforms. Platform dependencies of clock_t size: The size of clock_t is not fixed by the C standard, and may differ between systems (32-bit and 64-bit). Sign extension: If clock_t is smaller than zend_long, and clock_t is a signed type, then sign extension may occur when converting to zend_long, leading to incorrect interpretation of the values. https://github.com/php/php-src/blob/28a083bddcacdad9ec2b846c2b87b2a6f3204bd5/ext/posix/posix.c#L386-L390 Found using [SVACE](https://www.ispras.ru/en/technologies/svace/) Author D. Chizhmak ### PHP Version ```plain PHP 8.3+ ``` ### Operating System _No response_

« previous php.bugs (#250252) next »