[php-src] Issue #23950: Integer overflow in mhash_keygen_s2k() length

From: Date: Sun, 27 Sep 2026 20:27:09 +0000
Subject: [php-src] Issue #23950: Integer overflow in mhash_keygen_s2k() length
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-252835@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/23950 Author: marc-mabe ### Description The following code: ```php <?php foreach ([2**31, 2**32, 2**32 + 16, PHP_INT_MAX] as $length) { try { var_dump(strlen(mhash_keygen_s2k(MHASH_MD5, 'password', 'salt', $length))); } catch (ValueError $e) { echo $e->getMessage(), "\n"; } } ``` Resulted in this output: ``` mhash_keygen_s2k(): Argument #4 ($length) must be a greater than 0 mhash_keygen_s2k(): Argument #4 ($length) must be a greater than 0 int(16) mhash_keygen_s2k(): Argument #4 ($length) must be a greater than 0 ``` But I expected this output instead: ``` mhash_keygen_s2k(): Argument #4 ($length) must be less than or equal to 2147483647 mhash_keygen_s2k(): Argument #4 ($length) must be less than or equal to 2147483647 mhash_keygen_s2k(): Argument #4 ($length) must be less than or equal to 2147483647 mhash_keygen_s2k(): Argument #4 ($length) must be less than or equal to 2147483647 ``` ### PHP Version ```plain PHP 8.4-dev ``` ### Operating System Linux

« previous php.bugs (#252835) next »