Skip to content

integer overflow in logical_filters.c:825:14 #18310

Closed as duplicate of#18309
Closed as duplicate of#18309
@chongwick

Description

@chongwick

Description

The following code:

<?php
$ipv6_test = array();

for ($i = 0; $i < 100000; $i++) {
    $ip = '0:'. str_repeat('0', 15 - strlen(bin2hex(random_bytes(6)))). ':'. bin2hex(random_bytes(2)). ':'. bin2hex(random_bytes(2)). ':'. bin2hex(random_bytes(2)). ':'. bin2hex(random_bytes(2)). ':'. bin2hex(random_bytes(4));
    $ipv6_test[$ip] = true;
}

foreach ($ipv6_test as $ip => $exp) {
    $out = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6);
    $out = $out!== false;
    if ($exp!= $out) {
        echo "$ip failed (expected ", $exp?"true":"false", ", got ",
            $out?"true":"false", ")\n";
    }
}

?>

Resulted in this output:

/nightly_php/php-src/ext/filter/logical_filters.c:825:14: runtime error: signed integer overflow: 208068286 * 16 cannot be represented in type 'int'

PHP Version

nightly

Operating System

ubuntu 22.04

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions