php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72536 gmp_random_bits / gmp_random abort reached
Submitted: 2016-07-03 06:47 UTC Modified: 2016-07-03 11:13 UTC
From: fernando at null-life dot com Assigned:
Status: Wont fix Package: GNU MP related
PHP Version: 7.0.8 OS: Windows
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2016-07-03 06:47 UTC] fernando at null-life dot com
Description:
------------
void *
__gmp_default_reallocate (void *oldptr, size_t old_size, size_t new_size)
{
  void *ret;

#ifdef DEBUG
  size_t req_size = new_size;

  if (old_size != 0)
    {
      mp_ptr p = oldptr;
      if (p[-1] != (0xdeadbeef << 31) + 0xdeafdeed)
	{
	  fprintf (stderr, "gmp: (realloc) data clobbered before allocation block\n");
	  abort ();
	}
      if (old_size % BYTES_PER_MP_LIMB == 0)
	if (p[old_size / BYTES_PER_MP_LIMB] != ~((0xdeadbeef << 31) + 0xdeafdeed))
	  {
	    fprintf (stderr, "gmp: (realloc) data clobbered after allocation block\n");
	    abort ();
	  }
      oldptr = p - 1;
    }

  new_size += 2 * BYTES_PER_MP_LIMB;
#endif

  ret = realloc (oldptr, new_size);
  if (ret == 0)
    {
#if defined _MSC_VER && defined _WIN64
        fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%llu new_size=%llu)\n", old_size, new_size);
#else
        fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%lu new_size=%lu)\n", old_size, new_size);
#endif
      abort ();
    }


This abort inside __gmp_default_reallocate is reached with the attached test scripts. Maybe a check can be implemented inside php-gmp extension to prevent it. Tested on 64 bits Windows.

Test script:
---------------
<?php

$v1=-4500000000;
echo gmp_random($v1); 
 
<?php
$v1=PHP_INT_MAX;
gmp_random_bits($v1); 

Expected result:
----------------
No crash

Actual result:
--------------
php.exe crashes

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-07-03 11:13 UTC] nikic@php.net
-Status: Open +Status: Wont fix
 [2016-07-03 11:13 UTC] nikic@php.net
Due to compatibility issues with other libraries that link against libgmp, we can no longer replace the GMP default allocator with our own infallible allocator. As such, OOM aborts in GMP will not be fixed.
 
PHP Copyright © 2001-2018 The PHP Group
All rights reserved.
Last updated: Mon Dec 17 03:01:26 2018 UTC