They don't make much sense to me.  Starting from the bottom, conftest.cpp is a 
test file generated by the autoconf/libtool chain and only used during the 
configure run.  So even if there was an issue in that, it really wouldn't matter 
since no user data ever gets to it, and even if it did, you are reporting it to 
the wrong project.

Next one up, ext/standard/var_unserializer.c line 228?  There is no substraction 
there.  But assuming it means close to line 228, it would be in the parse_iv2() 
function?  I see nothing wrong with that code.  The only code in it that does 
any sort of addition is:

        if (cursor >= '0' && cursor <= '9') {
            result = result * 10 + cursor - '0';

How exactly do you get a signed subtraction overflow from that?  cursor is 
constrained and result is initialized to 0.

The 3rd last one seems to point at the same code.

There may very well be bugs hiding in there, but a static analysis full of false 
positives isn't very useful.

Hi--  It's not static analysis and there are no false positives.  These behaviors really happen (unless our tool is buggy, of course this is always possible).

Yes, I should have edited out the undefined behavior that occurred during conftest.

My copy of var_unserializer.c has this code at line 228:

	result = result * 10 + cursor - '0';

It looks to me like "result * 10 + cursor" evaluates to -2147483601 and then the subtraction overflow occurs.  This is not obvious?  Anyway, this is easy to verify: put an appropriate assertion in the code and run "make test" yourself.

No, it isn't obvious since that line of code is only executed when the value of 
cursor is between '0' and '9'.  It would require the argument to parse_iv2() to be  
above MAXINT which re2c checks for earlier.

Hi Rasmus-- You're right, this overflow is not totally obvious. It occurs when '2147483647;' is passed to parse_iv2() in this test:

  ext/standard/tests/serialize/serialization_miscTypes_001.phpt

The first problem is that the signed add in (result * 10 + cursor) overflows; the subtraction overflow is secondary.  If you re-associate the expression and instead compute (result * 10 + (cursor - '0')) the problems go away.

To reiterate: this isn't static analysis.  Our tool runs your code under your test suite and looks for integer operations that the C standard tells us are undefined.  I manually verified a few more of these reported bugs and they were also real.  Anyway, I leave the rest to you.  Thanks.

Do you have a way to generate the list with the test case filename that triggered 
the problem?

Is there a way to attach files here?  Anyway I've put a verbose error log here:

http://www.cs.utah.edu/~regehr/php-trunk-201008060430-errors.txt

Searching for lines containing the string "CLANG UNDEFINED" in this log should give you the right information.

Hey, we are starting to see the light on these.  Some of them are quite subtle.  Is this tool available so we can check out fixes and run it on a continuous basis before new releases?

The tool isn't yet available.  It is a modified version of LLVM's Clang compiler and it still has some rough edges that we're working out.  However, we'll contribute it to the LLVM project fairly soon, at which point it'll be really easy to run as you suggest.  In the meantime I'd be happy to rerun it in a few weeks or whenever seems good to you.

FYI there are a few bogus errors in the list I posted earlier.  Obviously (35 - 33) is well-defined in C.  Sorry about that.  It should be easy to recognize and ignore these.

Below are some updated results from our integer undefined behavior checker.  These are from php-trunk-201009022030 on x86-64 Linux.

The .log files from "make test" can be found here:

http://www.cs.utah.edu/~regehr/php-trunk-201009022030.test-logs.tar.gz

Basically you just want to grep for "CLANG UNDEFINED" in these files.

Summary:

</home/regehr/z/php-trunk-201009022030/Zend/zend_hash.h, (350:2)> : Op: +, Reason : Signed Addition Overflow, BINARY OPERATION: left (int64): 9223372036854775800 right (int64): 8 

</home/regehr/z/php-trunk-201009022030/Zend/zend_hash.h, (350:2)> : Op: -, Reason : Signed Subtraction Overflow, UNARY OPERATION: left (int64): 0 right (int64): -9223372036854775808 

</home/regehr/z/php-trunk-201009022030/Zend/zend_operators.c, (1181:2)> : Op: <<, Reason : Signed Left Shift: Right operand is negative or is greater than or equal to the width of the promoted left operand, BINARY OPERATION: left (int64): 0 right (int64): 65 

</home/regehr/z/php-trunk-201009022030/Zend/zend_operators.c, (1194:2)> : Op: >>, Reason : Signed Right Shift: Right operand is negative or is greater than or equal to the width of the promoted left operand, BINARY OPERATION: left (int64): 0 right (int64): 65 

</home/regehr/z/php-trunk-201009022030/Zend/zend_operators.c, (766:31)> : Op: +, Reason : Signed Addition Overflow, BINARY OPERATION: left (int64): 9223372036854775807 right (int64): 1 

</home/regehr/z/php-trunk-201009022030/Zend/zend_operators.c, (828:31)> : Op: -, Reason : Signed Subtraction Overflow, BINARY OPERATION: left (int64): -9223372036854775808 right (int64): 1 

</home/regehr/z/php-trunk-201009022030/Zend/zend_operators.c, (877:5)> : Op: *, Reason : Signed Multiplication Overflow, BINARY OPERATION: left (int64): 9223372036854775807 right (int64): 7 

</home/regehr/z/php-trunk-201009022030/ext/date/lib/parse_tz.c, (133:35)> : Op: *, Reason : Signed Multiplication Overflow, BINARY OPERATION: left (int32): 255 right (int32): 16777216 

</home/regehr/z/php-trunk-201009022030/ext/standard/math.c, (616:5)> : Op: *, Reason : Signed Multiplication Overflow, BINARY OPERATION: left (int64): 2147483647 right (int64): 4611686014132420609 

</home/regehr/z/php-trunk-201009022030/ext/standard/math.c, (620:5)> : Op: *, Reason : Signed Multiplication Overflow, BINARY OPERATION: left (int64): 110075314176 right (int64): 110075314176

Updated results from today's PHP.

ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/ext/date/lib/parse_tz.c, 
(135:35)> : Op: *, Reason : Signed Multiplication Overflow, BINARY OPERATION: 
left (int32): 255 right (int32): 16777216 

ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/ext/standard/math.c, (148:24)> 
: Op: -, Reason : Signed Subtraction Overflow, BINARY OPERATION: left (int32): 
14 right (int32): -2147483648 

ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_hash.h, (350:2)> : 
Op: -, Reason : Signed Subtraction Overflow, UNARY OPERATION: left (int64): 0 
right (int64): -9223372036854775808 

ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_operators.c, 
(1178:2)> : Op: <<, Reason : Signed Left Shift: Right operand is negative or is 
greater than or equal to the width of the promoted left operand, BINARY 
OPERATION: left (int64): 0 right (int64): 65 

ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_operators.c, 
(1178:2)> : Op: <<, Reason : Signed Left Shift: Right operand is negative or is 
greater than or equal to the width of the promoted left operand, BINARY 
OPERATION: left (int64): 9223372036854775807 right (int64): -1 

ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_operators.c, 
(1191:2)> : Op: >>, Reason : Signed Right Shift: Right operand is negative or is 
greater than or equal to the width of the promoted left operand, BINARY 
OPERATION: left (int64): 0 right (int64): 65 

ARITHMETIC UNDEFINED at </home/regehr/tmp/php-src/Zend/zend_operators.c, 
(1191:2)> : Op: >>, Reason : Signed Right Shift: Right operand is negative or is 
greater than or equal to the width of the promoted left operand, BINARY 
OPERATION: left (int64): 9223372036854775807 right (int64): -1

Also, our integer overflow checking tool can now be grabbed here:

http://embed.cs.utah.edu/ioc/

Any chance on getting an updated report or some automatic report?

Sure I'll do this tonight.

See below.  I got this by using "clang -fsanitize=undefined" to compile today's PHP from git, then running "make test".  These kinds of problems are generally pretty easy to debug by putting an assertion in front of each offending line of code.

Zend/zend_execute_API.c:146:46: runtime error: index -1 out of bounds for type 'HashTable *[32]'

Zend/zend_execute_API.c:146:46: runtime error: index -1 out of bounds for type 'HashTable *[32]'

Zend/zend_operators.c:1287:2: runtime error: shift exponent 65 is too large for 64-bit type 'long'

Zend/zend_operators.c:1307:2: runtime error: shift exponent -1 is negative

Zend/zend_operators.c:1307:2: runtime error: shift exponent 65 is too large for 64-bit type 'long'

Zend/zend_operators.h:108: runtime error: value nan is outside the range of representable values of type 'long'

ext/date/lib/parse_tz.c:135:35: runtime error: signed integer overflow: 255 * 16777216 cannot be represented in type 'int'

ext/phar/zip.c:150:34: runtime error: left shift of negative value -11

ext/sqlite3/libsqlite/sqlite3.c:57012:22: runtime error: member access within null pointer of type 'Mem' (aka 'struct Mem')

ext/standard/crypt_freesec.c:632:15: runtime error: left shift of negative value -61

ext/standard/math.c:148:24: runtime error: signed integer overflow: 14 - -2147483648 cannot be represented in type 'int'

ext/standard/math.c:41: runtime error: value -inf is outside the range of representable values of type 'int'

ext/standard/string.c:1671: runtime error: value 1.01235e+11 is outside the range of representable values of type 'int'

ext/standard/string.c:1671: runtime error: value 1.05e+11 is outside the range of representable values of type 'int'

ext/standard/url_scanner_ex.re:414:57: runtime error: member access within null pointer of type 'url_adapt_state_ex_t'

No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Re-Opened". Thank you.