integer overflow in logical_filters.c:825:14

[chongwick]

Description

The following code:

<?php
$ipv6_test = array();

for ($i = 0; $i < 100000; $i++) {
    $ip = '0:'. str_repeat('0', 15 - strlen(bin2hex(random_bytes(6)))). ':'. bin2hex(random_bytes(2)). ':'. bin2hex(random_bytes(2)). ':'. bin2hex(random_bytes(2)). ':'. bin2hex(random_bytes(2)). ':'. bin2hex(random_bytes(4));
    $ipv6_test[$ip] = true;
}

foreach ($ipv6_test as $ip => $exp) {
    $out = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
    $out = $out!== false;
    if ($exp!= $out) {
        echo "$ip failed (expected ", $exp?"true":"false", ", got ",
            $out?"true":"false", ")\n";
    }
}

?>

Resulted in this output:

/nightly_php/php-src/ext/filter/logical_filters.c:825:14: runtime error: signed integer overflow: 208068286 * 16 cannot be represented in type 'int'

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

Duplicate of #18309