Repository navigation
php-gmp is using a version of libgmp that terminates the process on several operations #18819
Description
Description
Unexpected mpz overflow, in the libgmp version used on php-gmp
The following code:
~ ❯❯❯ php8.4 -a ✘ 134
Interactive shell
php > $trigger=0xfffffffff; $a = gmp_init("241"); $b = 137; $a = gmp_mul($a, gmp_pow(2, $b)); $a = gmp_strval( gmp_pow( $b, $trigger)); echo $a . "\n";Resulted in this output:
gmp: overflow in mpz type
fish: Job 1, 'php8.4 -a' terminated by signal SIGABRT (Abort)
php-gmp is using a version of the library libgmp that __gmpz_n_pow_ui triggers abort() on specific cases.
They uses MUL instruction and check if rdx>0 then abort process.
if $trigger is 0xffffffff --> consume resources infinitely (prolly because my php.ini's memory_limit = -1)
if $trigger is 0xfffffffff -> abort() call ends the php process.
regards.
PHP Version
PHP 8.4.7 (cli) (built: May 9 2025 06:54:08) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.7, Copyright (c) Zend Technologies
with Zend OPcache v8.4.7, Copyright (c), by Zend Technologies
Operating System
pop-os
Activity
sha0coder commentedon Jun 10, 2025
Prolly the expected output instead the abort() is:
what do you think?
Girgias commentedon Jun 10, 2025
We do not bundle libgmp, and this seems to be an issue upstream with libgmp rather than PHP. Have you reported this upstream?
devnexen commentedon Jun 10, 2025
I think that s a voluntary design @Girgias, see this old PR (reverted since).
ndossche commentedon Jun 10, 2025
Isn't this essentially a duplicate of both #16502 and #16878 ?
Libgmp doesn't do graceful error handling here so ideally it should get that fixed at the library level.
sha0coder commentedon Jun 10, 2025
Yes it seems it's duplicated, the error in my case is not a segfault is an abort, i checked latest verison of libgmp and similar problem, the php process is terminated by libgmp.
Im not sure if it's only libgmp's problem since affects php-gmp, but Im glad that you are already aware.
regards.