[php-src] Issue #18841: Potential overflow and sign-extension issues in posix_times() when converting clock_t to zend_long
| From: | DehartShow | Date: | Thu, 12 Jun 2025 16:36:07 +0000 |
| Subject: | [php-src] Issue #18841: Potential overflow and sign-extension issues in posix_times() when converting clock_t to zend_long | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-250252@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/18841
Author: DehartShow
### Description
There is a potential security issue when converting
clock_t to zend_long
that could lead to unpredictable results on different platforms. Platform dependencies of
clock_t size: The size of clock_t is not fixed by the C standard, and may
differ between systems (32-bit and 64-bit). Sign extension: If clock_t is smaller than
zend_long, and clock_t is a signed type, then sign extension may occur
when converting to zend_long, leading to incorrect interpretation of the values.
https://github.com/php/php-src/blob/28a083bddcacdad9ec2b846c2b87b2a6f3204bd5/ext/posix/posix.c#L386-L390
Found using [SVACE](https://www.ispras.ru/en/technologies/svace/)
Author D. Chizhmak
### PHP Version
```plain
PHP 8.3+
```
### Operating System
_No response_