Segmentation fault (address overflow) in ext/bcmath/libbcmath/src/div.c:55

[YuanchengJiang]

Description

The following code:

<?php
bcdiv(1,300,1);

Resulted in this output:

/php-src/ext/bcmath/libbcmath/src/div.c:55:7: runtime error: addition of unsigned offset to 0x7f4af5c02120 overflowed to 0x7f4af5c02118

PHP Version

nightly

Operating System

ubuntu 22.04

[nielsdos]

Likely related to #16262

[cmb69]

Not sure. This one fails due to unsigned underflow in bc_fast_div() (bc_standard_div() would have the same issue):

php-src/ext/bcmath/libbcmath/src/div.c

Line 52 in 35c8a01

size_t numerator_top_index = numerator_arr_size - 1;

As such, it is more related to #16265.

While #16262 fails due to unsigned underflow earlier:

php-src/ext/bcmath/libbcmath/src/div.c

Line 445 in 35c8a01

size_t numerator_readable_len = numeratorend - numeratorptr + 1;