[PHP-BUG] Bug #71197 [NEW]: 2 more segfaults in PHP's range() function

[email protected] ("[email protected]")
Newsgroups php.bugs
Message-ID <[email protected]>
From:             tpunt
Operating system: Mac OS X Yosemite
PHP version:      7.0.1
Package:          Reproducible crash
Bug Type:         Bug
Bug description:2 more segfaults in PHP's range() function

Description:
------------
The segfaults are caused by precision loss of large longs being
converted to doubles when the `step` parameter is a double. The for
loops continue infinitely since the `step` being added/subtracted upon
each iteration is too small to be represented accurately as a double.

The attached patch adds another condition to each of the for loops by
ensuring that the number of iterations in the loop are less than the
size of the range (`__calc_size`). This prevents both loops from
continuing until segfaulting, however doesn't give an accurate result
(due to `__calc_size` being incorrect because of aforementioned
precision loss).

Test script:
---------------
var_dump(count(range(PHP_INT_MIN, PHP_INT_MIN + 513, .01)));
var_dump(count(range(PHP_INT_MIN + 513, PHP_INT_MIN, .01)));

Expected result:
----------------
// A completely correct output would be:
int(51400)
int(51400)

Actual result:
--------------
Segmentation fault: 11
Segmentation fault: 11

-- 
Edit bug report at https://bugs.php.net/bug.php?id=71197&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=71197&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=71197&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=71197&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=71197&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=71197&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=71197&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=71197&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=71197&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=71197&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=71197&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=71197&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=71197&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=71197&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71197&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=71197&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=71197&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=71197&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71197&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=71197&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=71197&r=mysqlcfg
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.