php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #72536 gmp_random_bits / gmp_random abort reached
Submitted: 2016-07-03 06:47 UTC Modified: 2016-07-03 11:13 UTC
From: fernando at null-life dot com Assigned:
Status: Wont fix Package: GNU MP related
PHP Version: 7.0.8 OS: Windows
Private report: No CVE-ID: None
View Add Comment Developer Edit
Anyone can comment on a bug. Have a simpler test case? Does it work for you on a different platform? Let us know!
Just going to say 'Me too!'? Don't clutter the database with that please — but make sure to vote on the bug!
Your email address:
MUST BE VALID
Solve the problem:
43 - 32 = ?
Subscribe to this entry?

 
 [2016-07-03 06:47 UTC] fernando at null-life dot com
Description:
------------
void *
__gmp_default_reallocate (void *oldptr, size_t old_size, size_t new_size)
{
  void *ret;

#ifdef DEBUG
  size_t req_size = new_size;

  if (old_size != 0)
    {
      mp_ptr p = oldptr;
      if (p[-1] != (0xdeadbeef << 31) + 0xdeafdeed)
	{
	  fprintf (stderr, "gmp: (realloc) data clobbered before allocation block\n");
	  abort ();
	}
      if (old_size % BYTES_PER_MP_LIMB == 0)
	if (p[old_size / BYTES_PER_MP_LIMB] != ~((0xdeadbeef << 31) + 0xdeafdeed))
	  {
	    fprintf (stderr, "gmp: (realloc) data clobbered after allocation block\n");
	    abort ();
	  }
      oldptr = p - 1;
    }

  new_size += 2 * BYTES_PER_MP_LIMB;
#endif

  ret = realloc (oldptr, new_size);
  if (ret == 0)
    {
#if defined _MSC_VER && defined _WIN64
        fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%llu new_size=%llu)\n", old_size, new_size);
#else
        fprintf (stderr, "GNU MP: Cannot reallocate memory (old_size=%lu new_size=%lu)\n", old_size, new_size);
#endif
      abort ();
    }


This abort inside __gmp_default_reallocate is reached with the attached test scripts. Maybe a check can be implemented inside php-gmp extension to prevent it. Tested on 64 bits Windows.

Test script:
---------------
<?php

$v1=-4500000000;
echo gmp_random($v1); 
 
<?php
$v1=PHP_INT_MAX;
gmp_random_bits($v1); 

Expected result:
----------------
No crash

Actual result:
--------------
php.exe crashes

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-07-03 11:13 UTC] nikic@php.net
-Status: Open +Status: Wont fix
 [2016-07-03 11:13 UTC] nikic@php.net
Due to compatibility issues with other libraries that link against libgmp, we can no longer replace the GMP default allocator with our own infallible allocator. As such, OOM aborts in GMP will not be fixed.
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Fri Mar 29 02:01:30 2024 UTC