Skip to content

Fix GH-16870: gmp_pow(64, 11) throws overflow exception#16884

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
cmb69 wants to merge 5 commits into from
Closed

Fix GH-16870: gmp_pow(64, 11) throws overflow exception #16884

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d5ed93b
Fix GH-16870: gmp_pow(64, 11) throws overflow exception
cmb69 Nov 21, 2024
4acc1b2
Remove now unused variable
cmb69 Nov 21, 2024
9ce9a4e
Count bits instead of bytes
cmb69 Nov 24, 2024
333524e
Use `mpz_sizeinbase(gmpnum_base, 2) - 1`
cmb69 Nov 25, 2024
3998435
More thorough testing
cmb69 Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions ext/gmp/gmp.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1350,22 +1350,20 @@ ZEND_FUNCTION(gmp_pow)
RETURN_THROWS();
}

double powmax = log((double)ZEND_LONG_MAX);
double max_bits = 16000; // TODO: value is very small, but passed current test suite

@cmb69cmb69Nov 25, 2024

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

max_bits is a misnomer now; it's actually something like max_double_bits. Maybe someone has an idea for a good name. Alternatively, we could double the value here, and check against > max_bits / 2.0 below. Shouldn't be a performance issue, if we declare const or use a macro.


if (Z_TYPE_P(base_arg) == IS_LONG && Z_LVAL_P(base_arg) >= 0) {
INIT_GMP_RETVAL(gmpnum_result);
if ((log(Z_LVAL_P(base_arg)) * exp) > powmax) {
if ((log2(Z_LVAL_P(base_arg)) * exp) > max_bits) {

@cmb69cmb69Nov 25, 2024

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For parity with the else branch, this should be

Suggested change
if ((log2(Z_LVAL_P(base_arg)) *exp) >max_bits) {
if ((floor(log2(Z_LVAL_P(base_arg))) *exp) >max_bits) {

But that would fail the last check in gmp_pow_fpe.phpt.

zend_value_error("base and exponent overflow");
RETURN_THROWS();
}
mpz_ui_pow_ui(gmpnum_result, Z_LVAL_P(base_arg), exp);
} else {
mpz_ptr gmpnum_base;
zend_ulong gmpnum;
FETCH_GMP_ZVAL(gmpnum_base, base_arg, temp_base, 1);
INIT_GMP_RETVAL(gmpnum_result);
gmpnum = mpz_get_ui(gmpnum_base);
if ((log(gmpnum) * exp) > powmax) {
if (((mpz_sizeinbase(gmpnum_base, 2) - 1) * exp) > max_bits) {
FREE_GMP_TEMP(temp_base);
zend_value_error("base and exponent overflow");
RETURN_THROWS();
Expand Down
44 changes: 44 additions & 0 deletions ext/gmp/tests/gh16870.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
--TEST--
GH-16870 (gmp_pow(64, 11) throws overflow exception)
--EXTENSIONS--
gmp
--FILE--
<?php
var_dump((string) gmp_pow(64, 11));
var_dump((string) gmp_pow(-1, PHP_INT_MAX));
var_dump((string) gmp_pow(0, PHP_INT_MAX));
var_dump((string) gmp_pow(1, PHP_INT_MAX));
var_dump((string) gmp_pow("-1", PHP_INT_MAX));
var_dump((string) gmp_pow("0", PHP_INT_MAX));
var_dump((string) gmp_pow("1", PHP_INT_MAX));
var_dump((string) gmp_pow(3, 10094));
Comment on lines +7 to +14

@GirgiasGirgiasNov 26, 2024

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add tests that use the ** operator, as those would also be affected I guess? Or did we somehow not covered this in the initial bug fix?

try {
var_dump((string) gmp_pow(3, 10095));
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
var_dump((string) gmp_pow("3", 16000));
try {
var_dump((string) gmp_pow("3", 16001));
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
try {
gmp_pow("18446744073709551616", 0x7fffffff);
} catch (ValueError $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
string(20) "73786976294838206464"
string(2) "-1"
string(1) "0"
string(1) "1"
string(2) "-1"
string(1) "0"
string(1) "1"
string(4817) "11533075637415496487592281331871174224637747280976783291049637915717488227409677235589985655833465069923970899504086533698509270485890415334138939234858553150826813059505821259421456502508459186875462194341065386126027027801534249219977601579402736284286658193223986383464522124431223004297979465911201782466728745878641327908224534851121272255882547583191118693484780082125687029148743930859469820619678076958478118783489386874938191595509014766881676382421423016318326239973711548512612598309512106273519481784053091183020220527884557279099056661262994370342893384956309190106859775380860788112440147017820801636914712819201261397772886095769514880661889558718248848498944978298184551864073632680231658424104129061352234739458896093955810573478729324201585738500508329505836621196751694435138391020244524002159614497981053936222615557057893320016368675928259661493908333929142877007002885770583505582564736312299864984293531873864785061265017587679806566346937678293678998816923947602772262547079648068153366270700158042945319861666957554360301554853013633335061966660135604818152043268703879168177293143076972823669959649421742685351867333233375304163232177777149647584860455637044208414453159294097804572134602265717132591722340206521295262152747278343230909914146841030285355493512813207869020568988470431918854802958290677478180815612525670586383633573558530284054578826178408362217876241833460468595240122498437860045968972498437913593528141080036063648369793150134377980502301181887963885053064585044647683192966091405359713319504738027316338262877696465232479348268959047133196943904242825585164714190795727177289193707936288448757607620884395915808810169838006401939994129380221798621603922122120110978533508520737364952338800186754919489090671539065182388363071753440332332249991931441542792540505050771825563716012931675348704705770151623950861159540884480458342871213236644751652034678244538551634573645445081249713336054306352098643138437770637045046645088903473177825834711859735016452422236013031965468217796705403248576918867778077692445192471434260249043920105606081135347705471262201478880521919759088254915924663179252552339836393647820778888239706561457303926528584995539088709710358964191141263305063547111178725937342302098044093057127459931531969143049596597192023941133832945605615334970253334228000275114412032554739404197725782911039011770988887590764320264786241103943964745418928079629108956619786453969570711590050691932385791267203614515551830325273413306776447458839519881809227379691968602616006998938263546188046854314963767036370641280548468755684510584427490525867039168065160950239341183895809995044275414602304583704717163464266405807330989661792426013150352392087304879788737912048852459292593719156210711473037637547103646633898687511717796971016064790324828663563087681469449755567209995580910951033394998762663853063178438599205534963057781410172898489892718908461868307071054446450561922351101300171637091591413816045421511530390792520180437209031104189440498889042828323443697952275508957192579916808786021116553372668204960814067368778487925938948510853284619996784341333402905801347256105023014742400298085781418992355245244156505542455222650319803872472017206844050437780143120498808268520589669594027795801438407544679315677995610024554202130961041463899262204300934333414826431857761050231879979281031546519214077200265877969102451689679880205621377656924576256346866648855273620211964454200666629878075419597919852822938780309508644306537653750021962025990643059595796196697895840873603111986834333194711636636348263344926116699951769640079227690346397831461531292290830418182071541604993899466537843235494262980341932336568387592159813596163181944639955690022622519454338194071345149482727629363247164883011183345428351495527322131091146630729105930006087949486403591684325160001638574604024394536745386047627900917257815847545171976792043319150875518285604781055959205372582776540005233644057612223824800964132529686684541425442628267789238706523810350415794716578754447768048781908772346231178543166514429377036603488773915367383002286671376468419724428841687176592794065754546867062875406331140604798929779064101927739181639627468245954232039869046707424467620707677501544195000789093397664181696452971158542902981581987839614407777681067561791112963614073029383140487183899555545496926164982886373099319907733644729223215119356475099918343507159953339661877757192384854128503625650657367508508660932110689248806971912244789249729377746967911203753323354211795666229306826885533076923224636360742503247191795910899694603683976297608514851769022529820637273260270472582103791801328333797745859172743767108242081619361527230269139392742585955692131235200252584005651254346885442923058733606248191257109473881785843652930393562387120056434695224498865819867705157369"
base and exponent overflow
string(7634) "87111504521824282722191762163591294184689937126632766882887494686514142632408070558872148350730819796230632953007530654826653012460426189019905103811958521334648689403935181818325934131053677042480136888934488688041764876899092412273443266620361812754834489183045290146335641582967988273645577789626458057487449189131752811960596754320521179128450071648403361231740559118448036833053187925860608328320062216504137491572647796774590865531458668781288128186015486239024749919477377479737655874963738647721533363222357723457819888245963501975005947116619060229123492686219109508248653336507937133424659327268307418693951481889477633041944263541048957635067266982804539974293247179373600874189481125419438202508389067302950224249685236681175984151712949973598181311763572201037202270574290946303078978091189884680790619931737358755062218126830936779296669037729496607237008458358671150267235588550382669915791714570119840920232871310744427859539105646376601568328436417261344788907121735688828967282693456906460500199605907231546135479387547253676910000639176276525595640123515129757506841955912493645597373023652135856879447774132699920039595409531251000932758147893752484661802285414958333487292244307172285221528747289665583190905992434139858049069328046427953545158237166395824766392244876676185117656538374044836287837733742074745748337506552055375164300677268738296477298791915758957454363211090803966112510959147608134528175889408275396973261242351212119239812308789565962415701371165159610343090987407607922738678848870923499390133222412884180198433484184253267154287653893940560723522072261654233277113654249475121547553009817167232759427183352518304440946558900156372423983261150987716751005105910592884568638457708934631960592874507455120762127231842682564251338438567638059385511211450894409128739007156318422568207645113346045019677277457167180277548300087952162607807787031997872919794519454753799419152797434887559422090881924944371677768080200790752524228473516288903374981320292056792099847230743772715877162018255056128547507514346085187767925156892250482344938677672569284333466279940470420765140970102476001654973462017223457205304310372093802797787015976810063654706654973174723235005335031267473698370109811984926788271219731624374255687307822832179100409882494942563378485831434560645457480984604150783659641167986180679285954868204693434917131311073502781140968854575617566263233536229361769905305038251986813510554449784565767739891576752987364833298478816146838877523535289240376553842714722597820204713027801643334985062325372292007749433460221227911710205854241223269149440109224940634653567164510914695768955192234422017944225110619623881976772992223707906775831670474083544563250961415933609623039509265196894444667056438692265970597142877417163095654159237531693688193707359565790399377344586338300841131659632577342149743668217384010900852575763319708316781463955275133914736730107162520180889223168520541114254085064614791238768393043692799154312834051034695852809230967438124879571458976959407650129392900680528899821694691664836024079855361988781983559604234878944170219621772679654565969112779015615490238513069488958861178814204733326243322017695565011067319183391040930829218759061843614118686756975173189160475394091172904199645357396127200013478242870830956358667558640812057646985082782959585938794954765094387135245027815219786946042441536625836370736787703966888271921115791162899118839910833655838184536573423258926229431341664942222942535136961774256617346584345872056800428425239796381016135145704898698875612333613224089348767144634749602978759317739476937465712595837523828865037440429889023077935614309284930717103744223577540346047070368220286689019863826260236369214773307699268235223607365043898701599268316592146462039711691382969167249088438797539066144442196116050732163770636912778956309060354986198967322695162520747352948024755865364225097978697735105217167988138241734603822231767331791529849178497996117657582405304155578886807459209161029332929071474323072806918641350445789294265460768361572596115937284678780007448388956776150830988303869513826606478186791715238425407829713816998080440729144112311798305498390821683542357637915216455619430581691319203242056463455535756344164993415956269079389867754824344944917192659542236150516774777854816043866192680540956487667379332375402197198849505892381440910622478240904689414468633593849456196704081573766176945499591549659185273983564994010504049622927117104735569959335886112963950175341775415851585261328807118625191297747178343810925741757385443158519495860727670654913659952615093420394287031927182381877999962533107134969950195530781302531508089623787554508980495948853266184315133614624802951683576458918789710991757893755788612527130476094659351251746661923755269906703131870128344777797661229707467074137545994751631853458217101990458202776553272704758536415816571304707175509488725592017252853587055606536170873840862122693439936651479453666001160065830309747063692670628764442161427689547640971960663283218292144794566120860105745597907022637058358493524528467379259430374453819505299107753346647867473396882174228582814334028276880523971804856413545596537757242132121730042896700005634457021670651384281009511585210164388664750583540154720843092607335407986885759406148835269382629173602453153827184684584242766969215800792031484612695895772797096967793586752394135226371000578687789240360733111726137646507247196650631711822880798957119978763816141429275598655313025099675573188620746800724845364422121746412901037975357421206073994966661816671816179521626689053555469799153508374413119366289126193731775916832897359266660913411936580265085445602993546253296188706680317653162299327065791027051230270147219976014883739761884160965165916207735042329667108851453962587438226723527468223343338143496770554635147265764472829762662922357479013798999553728121156942358592304494644937440005912741196883135781132870626724479364582108159262626732117691376944389661472228650837461821298390213772672001094214834237224668620613503244049933127001813399243732452801895641118453559195916964463593385845218759351129233595727373698691022684770571622643764169407791589249053208536665774656592512515692654038334060189180727930941016180384114006175179807322863669689127228106620553355587046179334292046470063465230334512357609351471829424478013039541273324741007492769830972400622855379356669571817256429779823645870165672203670254183877074539327799695412815651992174951121902154856139236310310228629041111681930818990670574579498534342175975215217926284158089201325222053348861341566311015316141542019173124012381690183169335660532152706786155598587453597264842187839671979232156134335728801212416294211424043740525944941380563982618445065479807528548301199329317474880689197396621138450895302423521006173332849136530354607507605188955392550267988406973666272950042904062752494851405868005243219820177331660776056229377736981331008319560206243369899799052874834544417190303566197085508476677019525493591815224196418668865778912390458097615808642590983287495860908240234171104841522185849767202496748662189624368092169366431953785463033473082342985539319926119411462159483352108566204235952875891987545602707072279517275441873055994983100021838067766732028222165661090511316737109482328868007706755947576415582261818279249130738729465902887348978722835658960732384295861871283431592106775416855160207844870807131639762433171840412817134098923806515586002001472505636695051128408190243506153976668032404087515031339166336337355646342475248543219866874741647803315049992496265778819567344997318886442479807500731463422276760932253683520001"
base and exponent overflow
base and exponent overflow
2 changes: 1 addition & 1 deletion ext/gmp/tests/gmp_pow_fpe.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -23,7 +23,7 @@ try {
echo $e->getMessage() . PHP_EOL;
}
try {
gmp_pow(gmp_init(PHP_INT_MAX), 256);
gmp_pow(PHP_INT_MAX, 256);
} catch (\ValueError $e) {
echo $e->getMessage();
}
Expand Down