[php-src] Issue #23950: Integer overflow in mhash_keygen_s2k() length
| From: | marc-mabe | Date: | Sun, 27 Sep 2026 20:27:09 +0000 |
| Subject: | [php-src] Issue #23950: Integer overflow in mhash_keygen_s2k() length | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-252835@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/23950
Author: marc-mabe
### Description
The following code:
```php
<?php
foreach ([2**31, 2**32, 2**32 + 16, PHP_INT_MAX] as $length) {
try {
var_dump(strlen(mhash_keygen_s2k(MHASH_MD5, 'password', 'salt',
$length)));
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
}
```
Resulted in this output:
```
mhash_keygen_s2k(): Argument #4 ($length) must be a greater than 0
mhash_keygen_s2k(): Argument #4 ($length) must be a greater than 0
int(16)
mhash_keygen_s2k(): Argument #4 ($length) must be a greater than 0
```
But I expected this output instead:
```
mhash_keygen_s2k(): Argument #4 ($length) must be less than or equal to 2147483647
mhash_keygen_s2k(): Argument #4 ($length) must be less than or equal to 2147483647
mhash_keygen_s2k(): Argument #4 ($length) must be less than or equal to 2147483647
mhash_keygen_s2k(): Argument #4 ($length) must be less than or equal to 2147483647
```
### PHP Version
```plain
PHP 8.4-dev
```
### Operating System
Linux