php-gmp is using a version of libgmp that terminates the process on several operations

[sha0coder]

Description

Unexpected mpz overflow, in the libgmp version used on php-gmp

The following code:

~ ❯❯❯ php8.4 -a                                                                                                                                         ✘ 134
Interactive shell

php > $trigger=0xfffffffff; $a = gmp_init("241"); $b = 137;  $a =  gmp_mul($a, gmp_pow(2, $b));   $a = gmp_strval( gmp_pow( $b, $trigger));  echo $a . "\n";

Resulted in this output:

gmp: overflow in mpz type
fish: Job 1, 'php8.4 -a' terminated by signal SIGABRT (Abort)

php-gmp is using a version of the library libgmp that __gmpz_n_pow_ui triggers abort() on specific cases.
They uses MUL instruction and check if rdx>0 then abort process.

if $trigger is 0xffffffff --> consume resources infinitely (prolly because my php.ini's memory_limit = -1)

if $trigger is 0xfffffffff -> abort() call ends the php process.

regards.

PHP Version

PHP 8.4.7 (cli) (built: May  9 2025 06:54:08) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.4.7, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.7, Copyright (c), by Zend Technologies

Operating System

pop-os

[sha0coder]

Prolly the expected output instead the abort() is:

PHP Warning:  Uncaught TypeError: gmp_pow(): Argument #2 ($exponent) must be of type int, GMP given in php shell code:1

what do you think?

[Girgias]

We do not bundle libgmp, and this seems to be an issue upstream with libgmp rather than PHP. Have you reported this upstream?

[devnexen]

I think that s a voluntary design @Girgias, see this old PR (reverted since).

[nielsdos]

Isn't this essentially a duplicate of both #16502 and #16878 ?
Libgmp doesn't do graceful error handling here so ideally it should get that fixed at the library level.

[sha0coder]

Yes it seems it's duplicated, the error in my case is not a segfault is an abort, i checked latest verison of libgmp and similar problem, the php process is terminated by libgmp.

Im not sure if it's only libgmp's problem since affects php-gmp, but Im glad that you are already aware.

regards.