php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72536 gmp_random_bits / gmp_random abort reached
Submitted: 2016-07-03 06:47 UTC Modified: 2016-07-03 11:13 UTC
From: fernando at null-life dot com Assigned:
Status: Wont fix Package: GNU MP related
PHP Version: 7.0.8 OS: Windows
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: fernando at null-life dot com
New email:
PHP Version: OS:

 

 [2016-07-03 06:47 UTC] fernando at null-life dot com
Description:
------------
void *
__gmp_default_reallocate (void *oldptr, size_t old_size, size_t new_size)
{
  void *ret;

#ifdef DEBUG
  size_t req_size = new_size;

  if (old_size != 0)
    {
      mp_ptr p = oldptr;
      if (p[-1] != (0xdeadbeef << 31) + 0xdeafdeed)
	{
	  fprintf (stderr, "gmp: (realloc) data clobbered before allocation block\n");
	  abort ();
	}
      if (old_size % BYTES_PER_MP_LIMB == 0)
	if (p[old_size / BYTES_PER_MP_LIMB] != ~((0xdeadbeef << 31) + 0xdeafdeed))
	  {
	    fprintf (stderr, "gmp: (realloc) data clobbered after allocation block\n");
	    abort ();
	  }
      oldptr = p - 1;
    }

  new_size += 2 * BYTES_PER_MP_LIMB;
#endif

  ret = realloc (oldptr, new_size);
  if (ret == 0)
    {
#if defined _MSC_VER && defined _WIN64
        fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%llu new_size=%llu)\n", old_size, new_size);
#else
        fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%lu new_size=%lu)\n", old_size, new_size);
#endif
      abort ();
    }


This abort inside __gmp_default_reallocate is reached with the attached test scripts. Maybe a check can be implemented inside php-gmp extension to prevent it. Tested on 64 bits Windows.

Test script:
---------------
<?php

$v1=-4500000000;
echo gmp_random($v1); 
 
<?php
$v1=PHP_INT_MAX;
gmp_random_bits($v1); 

Expected result:
----------------
No crash

Actual result:
--------------
php.exe crashes

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-07-03 11:13 UTC] nikic@php.net
-Status: Open +Status: Wont fix
 [2016-07-03 11:13 UTC] nikic@php.net
Due to compatibility issues with other libraries that link against libgmp, we can no longer replace the GMP default allocator with our own infallible allocator. As such, OOM aborts in GMP will not be fixed.
 
PHP Copyright © 2001-2018 The PHP Group
All rights reserved.
Last updated: Thu Nov 15 04:01:25 2018 UTC