Skip to content

ext/gmp: Fix GMP operator RHS overflow for GMP values#22656

Merged
LamentXU123 merged 3 commits into
php:masterfrom
LamentXU123:gmp-overflow-1
Jul 15, 2026
Merged

ext/gmp: Fix GMP operator RHS overflow for GMP values#22656
LamentXU123 merged 3 commits into
php:masterfrom
LamentXU123:gmp-overflow-1

Conversation

@LamentXU123

@LamentXU123 LamentXU123 commented Jul 9, 2026

Copy link
Copy Markdown
Member
<?php
$too_large = gmp_init("18446744073709551616");

var_dump(gmp_init(2) ** $too_large);
var_dump(gmp_init(2) << $too_large);
object(GMP)#3 (1) {
  ["num"]=>
  string(1) "1"
}
object(GMP)#2 (1) {
  ["num"]=>
  string(1) "2"
}

This PR fix the overflow by rejecting large gmp objects in these calculation (throws ValueError)

@LamentXU123 LamentXU123 requested a review from Girgias as a code owner July 9, 2026 17:16
@LamentXU123 LamentXU123 requested a review from iliaal July 10, 2026 18:16

@iliaal iliaal left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. One optional thing: the new test could add a >> case since it goes through the same helper.

Comment thread ext/gmp/gmp.c Outdated
Comment thread ext/gmp/gmp.c Outdated
@LamentXU123 LamentXU123 merged commit e2ea940 into php:master Jul 15, 2026
18 checks passed
@LamentXU123

Copy link
Copy Markdown
Member Author

Thank you!

@LamentXU123 LamentXU123 deleted the gmp-overflow-1 branch July 15, 2026 12:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants