Repository navigation
Segmentation fault (access null pointer) in ext/bcmath/libbcmath/src/rmzero.c:50 #16236
Description
Description
The following code:
<?php
$values = ['12.5', '-12.5'];
$exponents = [
[new BcMath\Number('-2'), 'object'],
];
foreach ($values as $fusion) {
$num = new BcMath\Number($value);
foreach ($exponents as [$exponent, $type]) {
$ret = $num->pow($exponent);
}
}Resulted in this output:
/php-src/ext/bcmath/libbcmath/src/rmzero.c:50:11: runtime error: member access within null pointer of type 'struct bc_struct'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/bcmath/libbcmath/src/rmzero.c:50:11
PHP Version
PHP 8.4.0-dev
Operating System
ubuntu 22.04
Reacted by Christoph M. Becker
Activity
cmb69 commentedon Oct 5, 2024
Simpler reproducer:
If
bc_raise()fails, it apparently doesn't changeresult, so this needs to be checked prior to dereferencing it.Interestingly,
https://3v4l.org/YmJUihttps://3v4l.org/YmJUi/rfc#outputcmb69 commentedon Oct 5, 2024
Or
bc_init_num()the variable to get the same doubtful result as withbcpow().SakiTakamachi commentedon Oct 7, 2024
Thank you for finding!
I resolved that, will open PR later.
Fixed a bug in BcMath\Number::pow() and bcpow() when raising negative…