Repository navigation
Power of 0 of BcMath number causes UB #20006
Description
Description
The following code:
<?php
function trace($v_1445,$v_1446,)
{
$v_1445 = $v_1445;
$v_1446 = $v_1446;
$v_1447 = define($v_1445,$v_1446,);
$v_1448 = "define $v_1445 ";
$v_1449 = $r ? "succeeded" : "failed";
$v_1450 = $v_1448 . $v_1449;
$v_1451 = defined($v_1445,);
if($v_1451){
$v_1453 = '; value is >';
$v_1454 = constant($v_1445,);
$v_1455 = $v_1453 . $v_1454;
$v_1456 = '<\n';
$v_1457 = $v_1455 . $v_1456;
}
else{
$v_1452 = '; not defined\n';
}
}
function foo($v_1549,)
{
$v_1549 = $v_1549;
return $v_1549;
}
$v_1540 = $value1;
$v_1547 = (string)($v_1540);
$v_1543 = $value2;
$v_1548 = new BcMath\Number($v_1543,);
$v_1549 = $v_1547 * $v_1548;
$v_324 = gmp_init($v_1549,);
$v_1541 = new BcMath\Number($v_1540,);
$v_1545 = (string)($v_1543);
$v_1546 = $v_1541 * $v_1545;
$v_323 = 2;
$v_326 = pow($v_1546,$v_323,);Resulted in this output:
/home/w023dtc/nightly_php/php-src/ext/bcmath/libbcmath/src/rmzero.c:50:11: runtime error: member access within null pointer of type 'struct bc_struct'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/bcmath/libbcmath/src/rmzero.c:50:11
PHP Version
nightly
Operating System
ubuntu 22.04
Activity
[-]undefined behavior in bcmatch[/-][+]undefined behavior in bcmath[/+]chongwick commentedon Sep 30, 2025
#16236?
ndossche commentedon Sep 30, 2025
ndossche commentedon Sep 30, 2025
Reduced to:
[-]undefined behavior in bcmath[/-][+]Power of 0 of BcMath number causes crash[/+][-]Power of 0 of BcMath number causes crash[/-][+]Power of 0 of BcMath number causes UB[/+]Fix phpGH-20006: Power of 0 of BcMath number causes UB
Fix GH-20006: Power of 0 of BcMath number causes UB
Merge branch 'PHP-8.5'