Skip to content

Revert gmp overflow #16934

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions NEWS
Original file line number Diff line number Diff line change
Expand Up @@ -14,13 +14,21 @@ PHP NEWS
(nielsdos)
. Fixed bug GH-16630 (UAF in lexer with encoding translation and heredocs).
(nielsdos)
. Fix is_zend_ptr() huge block comparison. (nielsdos)

- Curl:
. Fix various memory leaks in curl mime handling. (nielsdos)

- FPM:
. Fixed GH-16432 (PHP-FPM 8.2 SIGSEGV in fpm_get_status). (Jakub Zelenka)

- GD:
. Fixed GH-16776 (imagecreatefromstring overflow). (David Carlier)

- GMP:
. Revert gmp_pow() overly restrictive overflow checks.
(David Carlier)

- Hash:
. Fixed GH-16711: Segfault in mhash(). (Girgias)

Expand All @@ -29,6 +37,7 @@ PHP NEWS
(nielsdos, Dmitry)
. Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).
(dktapps)
. Fixed bug GH-16902 (Set of opcache tests fail zts+aarch64). (nielsdos)

- OpenSSL:
. Prevent unexpected array entry conversion when reading key. (nielsdos)
Expand All @@ -42,10 +51,17 @@ PHP NEWS
. Fixed bug GH-16695 (phar:// tar parser and zero-length file header blocks).
(nielsdos, Hans Krentel)

- PHPDBG:
. Fixed bug GH-15208 (Segfault with breakpoint map and phpdbg_clear()).
(nielsdos)

- SimpleXML:
. Fixed bug GH-16808 (Segmentation fault in RecursiveIteratorIterator
->current() with a xml element input). (nielsdos)

- Windows:
. Fixed bug GH-16849 (Error dialog causes process to hang). (cmb)

21 Nov 2024, PHP 8.2.26

- CLI:
Expand Down
13 changes: 0 additions & 13 deletions ext/gmp/gmp.c
Original file line number Diff line number Diff line change
Expand Up @@ -1350,26 +1350,13 @@ ZEND_FUNCTION(gmp_pow)
RETURN_THROWS();
}

double powmax = log((double)ZEND_LONG_MAX);

if (Z_TYPE_P(base_arg) == IS_LONG && Z_LVAL_P(base_arg) >= 0) {
INIT_GMP_RETVAL(gmpnum_result);
if ((log(Z_LVAL_P(base_arg)) * exp) > powmax) {
zend_value_error("base and exponent overflow");
RETURN_THROWS();
}
mpz_ui_pow_ui(gmpnum_result, Z_LVAL_P(base_arg), exp);
} else {
mpz_ptr gmpnum_base;
zend_ulong gmpnum;
FETCH_GMP_ZVAL(gmpnum_base, base_arg, temp_base, 1);
INIT_GMP_RETVAL(gmpnum_result);
gmpnum = mpz_get_ui(gmpnum_base);
if ((log(gmpnum) * exp) > powmax) {
FREE_GMP_TEMP(temp_base);
zend_value_error("base and exponent overflow");
RETURN_THROWS();
}
mpz_pow_ui(gmpnum_result, gmpnum_base, exp);
FREE_GMP_TEMP(temp_base);
}
Expand Down
2 changes: 0 additions & 2 deletions ext/gmp/tests/gmp_pow.phpt
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,6 @@
gmp_pow() basic tests
--EXTENSIONS--
gmp
--SKIPIF--
<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
--FILE--
<?php

Expand Down
77 changes: 0 additions & 77 deletions ext/gmp/tests/gmp_pow_32bits.phpt

This file was deleted.

35 changes: 0 additions & 35 deletions ext/gmp/tests/gmp_pow_fpe.phpt

This file was deleted.

Loading