php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #64109 incorrect use of abs() in array_pad()
Submitted: 2013-01-30 21:33 UTC Modified: 2017-10-24 08:35 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:0 of 0 (0.0%)
From: xi dot wang at gmail dot com Assigned: requinix (profile)
Status: Closed Package: Arrays related
PHP Version: master-Git-2013-01-30 (Git) OS:
Private report: No CVE-ID: None
 [2013-01-30 21:33 UTC] xi dot wang at gmail dot com
Description:
------------
Using `abs(pad_size) < 0' to catch the LONG_MIN case invokes undefined behavior in 
C.  gcc simply assumes abs(pad_size) must be non-negative and discards the check.

Test script:
---------------
<?php
// This is for 64-bit systems.
$input = array(12, 10, 9);
$input = array_pad($input, -9223372036854775808, 0);
var_dump($input);
?>

Expected result:
----------------
Warning: array_pad(): You may only pad up to 1048576 elements at a time in t.php 
on line 3
bool(false)

Actual result:
--------------
array(3) {
  [0]=>
  int(12)
  [1]=>
  int(10)
  [2]=>
  int(9)
}

Patches

abs (last revision 2013-01-30 21:34 UTC by xi dot wang at gmail dot com)

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2013-02-17 03:46 UTC] laruence@php.net
-Assigned To: +Assigned To: laruence
 [2013-02-17 03:46 UTC] laruence@php.net
actually, there are some other issues,  like use abs on a long number.  

I am not sure whether this is a critical bug, but will try to fix it only for 5.4+
 [2017-10-24 08:04 UTC] kalle@php.net
-Status: Assigned +Status: Open -Assigned To: laruence +Assigned To:
 [2017-10-24 08:35 UTC] requinix@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: requinix
 [2017-10-24 08:35 UTC] requinix@php.net
Fixed since PHP 7. https://3v4l.org/pWJc7
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Mar 28 08:01:28 2024 UTC