[php-src] Issue #22148: ext/posix: posix_times() converts clock_t values to zend_long without range checks
[email protected] (crystarm) Mon, 25 May 2026 14:19:05 +0000
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/22148
Author: crystarm
### Description
I'm not sure which issue category is the best fit, so I'm filing this as a bug.
I have several static analyzer messages like [SIGN_EXTENSION posix.c:\[387:2\].log](https://github.com/user-attachments/files/28225704/SIGN_EXTENSION.posix.c.387.2.log).
`clock_t` is implementation-defined (size/signedness), while `zend_long` is platform-dependent (`32-bit` on 32-bit builds, `64-bit` on 64-bit builds).
If a `clock_t` value is not representable as `zend_long`, conversion result is implementation-defined and may truncate / flip sign.
**This seems like a portability/correctness issue, (not a security issue)**, and probably rare in practice.
Could somebody clarify whether this is worth fixing?
### PHP Version
```plain
PHP 8.4.21 (cli) (built: May 8 2026 05:56:48) (NTS)
Copyright (c) The PHP Group
Built by Debian
Zend Engine v4.4.21, Copyright (c) Zend Technologies
with Zend OPcache v8.4.21, Copyright (c), by Zend Technologies
```
### Operating System
Debian 13