Skip to content

Commit 9e2367f

Browse files
GirgiasGirgias
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: ext/gmp: Fix segfault when null is encountered on an overloaded operator ext/gmp: Add behavioural tests for operator overloading
2 parents 68d3000 + 65d4234 commit 9e2367f

13 files changed

+1097
-10
lines changed

‎NEWS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ PHP NEWS
2222
. Fixed bug GH-16559 (UBSan abort in ext/gd/libgd/gd_interpolation.c:1007).
2323
(nielsdos)
2424

25+
- GMP:
26+
. Fixed segfaults and other issues related to operator overloading with
27+
GMP objects. (Girgias)
28+
2529
- Opcache:
2630
. Fixed bug GH-16572 (Incorrect result with reflection in low-trigger JIT).
2731
(nielsdos)

‎ext/gmp/gmp.c‎

Lines changed: 78 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -338,25 +338,89 @@ static zend_object *gmp_clone_obj(zend_object *obj) /* {{{ */
338338
}
339339
/* }}} */
340340

341-
static void shift_operator_helper(gmp_binary_ui_op_t op, zval *return_value, zval *op1, zval *op2, uint8_t opcode) {
342-
zend_long shift = zval_get_long(op2);
341+
static zend_result shift_operator_helper(gmp_binary_ui_op_t op, zval *return_value, zval *op1, zval *op2, uint8_t opcode) {
342+
zend_long shift = 0;
343+
344+
if (UNEXPECTED(Z_TYPE_P(op2) != IS_LONG)) {
345+
if (UNEXPECTED(!IS_GMP(op2))) {
346+
// For PHP 8.3 and up use zend_try_get_long()
347+
switch (Z_TYPE_P(op2)) {
348+
case IS_DOUBLE:
349+
shift = zval_get_long(op2);
350+
if (UNEXPECTED(EG(exception))) {
351+
return FAILURE;
352+
}
353+
break;
354+
case IS_STRING:
355+
if (is_numeric_str_function(Z_STR_P(op2), &shift, NULL) != IS_LONG) {
356+
goto valueof_op_failure;
357+
}
358+
break;
359+
default:
360+
goto typeof_op_failure;
361+
}
362+
} else {
363+
// TODO We shouldn't cast the GMP object to int here
364+
shift = zval_get_long(op2);
365+
}
366+
} else {
367+
shift = Z_LVAL_P(op2);
368+
}
343369

344370
if (shift < 0) {
345371
zend_throw_error(
346372
zend_ce_value_error, "%s must be greater than or equal to 0",
347373
opcode == ZEND_POW ? "Exponent" : "Shift"
348374
);
349375
ZVAL_UNDEF(return_value);
350-
return;
376+
return FAILURE;
351377
} else {
352378
mpz_ptr gmpnum_op, gmpnum_result;
353379
gmp_temp_t temp;
354380

355-
FETCH_GMP_ZVAL(gmpnum_op, op1, temp, 1);
381+
/* We do not use FETCH_GMP_ZVAL(...); here as we don't use convert_to_gmp()
382+
* as we want to handle the emitted exception ourself. */
383+
if (UNEXPECTED(!IS_GMP(op1))) {
384+
if (UNEXPECTED(Z_TYPE_P(op1) != IS_LONG)) {
385+
goto typeof_op_failure;
386+
}
387+
mpz_init(temp.num);
388+
mpz_set_si(temp.num, Z_LVAL_P(op1));
389+
temp.is_used = 1;
390+
gmpnum_op = temp.num;
391+
} else {
392+
gmpnum_op = GET_GMP_FROM_ZVAL(op1);
393+
temp.is_used = 0;
394+
}
356395
INIT_GMP_RETVAL(gmpnum_result);
357396
op(gmpnum_result, gmpnum_op, (gmp_ulong) shift);
358397
FREE_GMP_TEMP(temp);
398+
return SUCCESS;
399+
}
400+
401+
typeof_op_failure: ;
402+
/* Returning FAILURE without throwing an exception would emit the
403+
* Unsupported operand types: GMP OP TypeOfOp2
404+
* However, this leads to the engine trying to interpret the GMP object as an integer
405+
* and doing the operation that way, which is not something we want. */
406+
const char *op_sigil;
407+
switch (opcode) {
408+
case ZEND_POW:
409+
op_sigil = "**";
410+
break;
411+
case ZEND_SL:
412+
op_sigil = "<<";
413+
break;
414+
case ZEND_SR:
415+
op_sigil = ">>";
416+
break;
417+
EMPTY_SWITCH_DEFAULT_CASE();
359418
}
419+
zend_type_error("Unsupported operand types: %s %s %s", zend_zval_type_name(op1), op_sigil, zend_zval_type_name(op2));
420+
return FAILURE;
421+
valueof_op_failure:
422+
zend_value_error("Number is not an integer string");
423+
return FAILURE;
360424
}
361425

362426
#define DO_BINARY_UI_OP_EX(op, uop, check_b_zero) \
@@ -385,18 +449,15 @@ static zend_result gmp_do_operation_ex(uint8_t opcode, zval *result, zval *op1,
385449
case ZEND_MUL:
386450
DO_BINARY_UI_OP(mpz_mul);
387451
case ZEND_POW:
388-
shift_operator_helper(mpz_pow_ui, result, op1, op2, opcode);
389-
return SUCCESS;
452+
return shift_operator_helper(mpz_pow_ui, result, op1, op2, opcode);
390453
case ZEND_DIV:
391454
DO_BINARY_UI_OP_EX(mpz_tdiv_q, gmp_mpz_tdiv_q_ui, 1);
392455
case ZEND_MOD:
393456
DO_BINARY_UI_OP_EX(mpz_mod, gmp_mpz_mod_ui, 1);
394457
case ZEND_SL:
395-
shift_operator_helper(mpz_mul_2exp, result, op1, op2, opcode);
396-
return SUCCESS;
458+
return shift_operator_helper(mpz_mul_2exp, result, op1, op2, opcode);
397459
case ZEND_SR:
398-
shift_operator_helper(mpz_fdiv_q_2exp, result, op1, op2, opcode);
399-
return SUCCESS;
460+
return shift_operator_helper(mpz_fdiv_q_2exp, result, op1, op2, opcode);
400461
case ZEND_BW_OR:
401462
DO_BINARY_OP(mpz_ior);
402463
case ZEND_BW_AND:
@@ -629,6 +690,13 @@ static zend_result convert_to_gmp(mpz_t gmpnumber, zval *val, zend_long base, ui
629690
case IS_STRING: {
630691
return convert_zstr_to_gmp(gmpnumber, Z_STR_P(val), base, arg_pos);
631692
}
693+
case IS_NULL:
694+
/* Just reject null for operator overloading */
695+
if (arg_pos == 0) {
696+
zend_type_error("Number must be of type GMP|string|int, %s given", zend_zval_type_name(val));
697+
return FAILURE;
698+
}
699+
ZEND_FALLTHROUGH;
632700
default: {
633701
zend_long lval;
634702
if (!zend_parse_arg_long_slow(val, &lval, arg_pos)) {

‎ext/gmp/tests/overloading_cmp_op_with_null.phpt‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
--TEST--
2+
GMP comparison operator overloading supports null
3+
--EXTENSIONS--
4+
gmp
5+
--FILE--
6+
<?php
7+
8+
$num = gmp_init(42);
9+
10+
try {
11+
var_dump($num < null);
12+
} catch (Throwable $e) {
13+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
14+
}
15+
16+
try {
17+
var_dump($num > null);
18+
} catch (Throwable $e) {
19+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
20+
}
21+
22+
try {
23+
var_dump($num <= null);
24+
} catch (Throwable $e) {
25+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
26+
}
27+
28+
try {
29+
var_dump($num >= null);
30+
} catch (Throwable $e) {
31+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
32+
}
33+
34+
try {
35+
var_dump($num == null);
36+
} catch (Throwable $e) {
37+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
38+
}
39+
40+
try {
41+
var_dump($num <=> null);
42+
} catch (Throwable $e) {
43+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
44+
}
45+
46+
?>
47+
--EXPECT--
48+
bool(false)
49+
bool(true)
50+
bool(false)
51+
bool(true)
52+
bool(false)
53+
int(1)

‎ext/gmp/tests/overloading_with_array.phpt‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
--TEST--
2+
GMP operator overloading does not support []
3+
--EXTENSIONS--
4+
gmp
5+
--FILE--
6+
<?php
7+
8+
$num = gmp_init(42);
9+
10+
try {
11+
var_dump($num + []);
12+
} catch (Throwable $e) {
13+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
14+
}
15+
16+
try {
17+
var_dump($num - []);
18+
} catch (Throwable $e) {
19+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
20+
}
21+
22+
try {
23+
var_dump($num * []);
24+
} catch (Throwable $e) {
25+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
26+
}
27+
28+
try {
29+
var_dump($num / []);
30+
} catch (Throwable $e) {
31+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
32+
}
33+
34+
try {
35+
var_dump($num % []);
36+
} catch (Throwable $e) {
37+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
38+
}
39+
40+
try {
41+
var_dump($num ** []);
42+
} catch (Throwable $e) {
43+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
44+
}
45+
46+
try {
47+
var_dump($num | []);
48+
} catch (Throwable $e) {
49+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
50+
}
51+
try {
52+
var_dump($num & []);
53+
} catch (Throwable $e) {
54+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
55+
}
56+
try {
57+
var_dump($num ^ []);
58+
} catch (Throwable $e) {
59+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
60+
}
61+
try {
62+
var_dump($num << []);
63+
} catch (Throwable $e) {
64+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
65+
}
66+
try {
67+
var_dump($num >> []);
68+
} catch (Throwable $e) {
69+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
70+
}
71+
72+
?>
73+
--EXPECT--
74+
TypeError: Number must be of type GMP|string|int, array given
75+
TypeError: Number must be of type GMP|string|int, array given
76+
TypeError: Number must be of type GMP|string|int, array given
77+
TypeError: Number must be of type GMP|string|int, array given
78+
TypeError: Number must be of type GMP|string|int, array given
79+
TypeError: Unsupported operand types: GMP ** array
80+
TypeError: Number must be of type GMP|string|int, array given
81+
TypeError: Number must be of type GMP|string|int, array given
82+
TypeError: Number must be of type GMP|string|int, array given
83+
TypeError: Unsupported operand types: GMP << array
84+
TypeError: Unsupported operand types: GMP >> array

‎ext/gmp/tests/overloading_with_float.phpt‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
--TEST--
2+
GMP operator overloading does support float with no fractional
3+
--EXTENSIONS--
4+
gmp
5+
--FILE--
6+
<?php
7+
8+
$num = gmp_init(42);
9+
10+
try {
11+
var_dump($num + 42.0);
12+
} catch (Throwable $e) {
13+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
14+
}
15+
16+
try {
17+
var_dump($num - 42.0);
18+
} catch (Throwable $e) {
19+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
20+
}
21+
22+
try {
23+
var_dump($num * 42.0);
24+
} catch (Throwable $e) {
25+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
26+
}
27+
28+
try {
29+
var_dump($num / 42.0);
30+
} catch (Throwable $e) {
31+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
32+
}
33+
34+
try {
35+
var_dump($num % 42.0);
36+
} catch (Throwable $e) {
37+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
38+
}
39+
40+
try {
41+
var_dump($num ** 42.0);
42+
} catch (Throwable $e) {
43+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
44+
}
45+
46+
try {
47+
var_dump($num | 42.0);
48+
} catch (Throwable $e) {
49+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
50+
}
51+
try {
52+
var_dump($num & 42.0);
53+
} catch (Throwable $e) {
54+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
55+
}
56+
try {
57+
var_dump($num ^ 42.0);
58+
} catch (Throwable $e) {
59+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
60+
}
61+
try {
62+
var_dump($num << 42.0);
63+
} catch (Throwable $e) {
64+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
65+
}
66+
try {
67+
var_dump($num >> 42.0);
68+
} catch (Throwable $e) {
69+
echo $e::class, ': ', $e->getMessage(), PHP_EOL;
70+
}
71+
72+
?>
73+
--EXPECT--
74+
object(GMP)#2 (1) {
75+
["num"]=>
76+
string(2) "84"
77+
}
78+
object(GMP)#2 (1) {
79+
["num"]=>
80+
string(1) "0"
81+
}
82+
object(GMP)#2 (1) {
83+
["num"]=>
84+
string(4) "1764"
85+
}
86+
object(GMP)#2 (1) {
87+
["num"]=>
88+
string(1) "1"
89+
}
90+
object(GMP)#2 (1) {
91+
["num"]=>
92+
string(1) "0"
93+
}
94+
object(GMP)#2 (1) {
95+
["num"]=>
96+
string(69) "150130937545296572356771972164254457814047970568738777235893533016064"
97+
}
98+
object(GMP)#2 (1) {
99+
["num"]=>
100+
string(2) "42"
101+
}
102+
object(GMP)#2 (1) {
103+
["num"]=>
104+
string(2) "42"
105+
}
106+
object(GMP)#2 (1) {
107+
["num"]=>
108+
string(1) "0"
109+
}
110+
object(GMP)#2 (1) {
111+
["num"]=>
112+
string(15) "184717953466368"
113+
}
114+
object(GMP)#2 (1) {
115+
["num"]=>
116+
string(1) "0"
117+
}

0 commit comments

Comments
 (0)