Skip to content

Fix GH-17384: Reject too large number_format decimals#22435

Open
LamentXU123 wants to merge 1 commit into
php:masterfrom
LamentXU123:number_format-ValueError
Open

Fix GH-17384: Reject too large number_format decimals#22435
LamentXU123 wants to merge 1 commit into
php:masterfrom
LamentXU123:number_format-ValueError

Conversation

@LamentXU123

Copy link
Copy Markdown
Contributor

number_format($number, 9876543210); is now silently equals to number_format($number, 2147483647); and generates 2147483647 decimal places and eat up 2 GB memory (and exhaust almost half of them which cause a fatal error).

I only reject very large positive numbers here (as every input larger than 2147483647 is silently turned into 2147483647). Because negative ones is always returning 0 anyways and only very large positive numbers can cause to such problems.

Fixes #17384

Comment thread ext/standard/math.c
Comment on lines +1418 to +1421
if (dec > INT_MAX) {
zend_argument_value_error(2, "must be less than or equal to %d", INT_MAX);
RETURN_THROWS();
}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Surely, to error on truncation?

Suggested change
if (dec > INT_MAX) {
zend_argument_value_error(2, "must be less than or equal to %d", INT_MAX);
RETURN_THROWS();
}
if (dec > INT_MAX || dec < INT_MIN) {
zend_argument_value_error(2, "must be between %d and %d", INT_MIN, INT_MAX);
RETURN_THROWS();
}

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm I don't think we should reject "large" negative numbers. They works fine (see: https://3v4l.org/4uI70#v) because they always returns to 0 and doesn't awkwardly allocates a whopping 2GB memories.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

number_format function gives an out of memory error for bad $decimals value

2 participants