[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client #11177

Closed
lucasnetau opened this issue May 2, 2023 · 1 comment
Closed

ASAN UndefinedBehaviorSanitizer when timeout = -1 passed to stream_socket_accept/stream_socket_client #11177

lucasnetau opened this issue May 2, 2023 · 1 comment
Labels
Bug Category: Streams Status: Verified

Comments

@lucasnetau
Copy link
Contributor

Description

The following code with ASAN enabled:

<?php
$socket = stream_socket_server("tcp://0.0.0.0:8080", $errno, $errstr);
$conn = stream_socket_accept($socket, -1);
fclose($conn);
fclose($socket);

Resulted in this output:

/php-debug/php-8.2.5/ext/standard/streamsfuncs.c:278:9: runtime error: -1e+06 is outside the range of representable values of type 'unsigned long long'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-debug/php-8.2.5/ext/standard/streamsfuncs.c:278:9 in 
Abort trap: 6

But I expected this output instead:

With the offending line being in stream_socket_accept modifying the timeout value and assigning a negative value to an unsigned long long (php_timeout_ull)

	/* prepare the timeout value for use */
	conv = (php_timeout_ull) (timeout * 1000000.0);

The same code and ASAN error can also be seen in stream_socket_client

PHP Version

PHP 8.2.5

Operating System

No response
@nielsdos
Copy link
Member
nielsdos commented May 2, 2023

Reproducible with Clang, not GCC strangely.

@nielsdos nielsdos mentioned this issue May 2, 2023
Closed
nielsdos added a commit to nielsdos/php-src that referenced this issue May 2, 2023
@nielsdos
Fix phpGH-11175 and phpGH-11177: Stream socket timeout undefined beha…
26605f4 
…viour

A negative value like -1 may overflow and cause incorrect results in the
timeout variable, which causes an immediate timeout. As this is caused
by undefined behaviour the exact behaviour depends on the compiler, its
version, and the platform.

A large overflow is also possible, if an extremely large timeout value
is passed we also set an indefinite timeout. This is because the timeout
value is at least a 64-bit number and waiting for UINT64_MAX/1000000
seconds is waiting about 584K years.
@nielsdos nielsdos mentioned this issue May 2, 2023
Closed
@nielsdos nielsdos linked a pull request May 2, 2023 that will close this issue
Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour #11183
Closed
nielsdos added a commit that referenced this issue May 3, 2023
@nielsdos
Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour
d75c1d0 
A negative value like -1 may overflow and cause incorrect results in the
timeout variable, which causes an immediate timeout. As this is caused
by undefined behaviour the exact behaviour depends on the compiler, its
version, and the platform.

A large overflow is also possible, if an extremely large timeout value
is passed we also set an indefinite timeout. This is because the timeout
value is at least a 64-bit number and waiting for UINT64_MAX/1000000
seconds is waiting about 584K years.

Closes GH-11183.
nielsdos added a commit that referenced this issue May 3, 2023
@nielsdos
Merge branch 'PHP-8.1' into PHP-8.2
ab3f584 
* PHP-8.1:
  Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)
  Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour
  Fix GH-9068: Conditional jump or move depends on uninitialised value(s)
nielsdos added a commit that referenced this issue May 3, 2023
@nielsdos
Merge branch 'PHP-8.2'
001e278 
* PHP-8.2:
  Fix GH-11178: Segmentation fault in spl_array_it_get_current_data (PHP 8.1.18)
  Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour
  Fix GH-9068: Conditional jump or move depends on uninitialised value(s)
@nielsdos nielsdos closed this as completed May 3, 2023
@pronskiy pronskiy mentioned this issue Jun 6, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug Category: Streams Status: Verified
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix GH-11175 and GH-11177: Stream socket timeout undefined behaviour nielsdos/php-src
3 participants
@nielsdos @lucasnetau and others