Skip to content

gmp_pow() crashes when exponent is PHP_INT_MAX #22351

@arshidkv12

Description

@arshidkv12

Description

The following code:

<?php
gmp_pow(2, PHP_INT_MAX);

Resulted in this output:

sapi/cli/php z.php         
AddressSanitizer:DEADLYSIGNAL
=================================================================
==150746==ERROR: AddressSanitizer: FPE on unknown address 0x03e800024cda (pc 0x7817bdc9eb2c bp 0x7ffc9b6798b0 sp 0x7ffc9b679870 T0)
    #0 0x7817bdc9eb2c in __pthread_kill_implementation nptl/./nptl/pthread_kill.c:44:76
    #1 0x7817bdc9eb2c in __pthread_kill_internal nptl/./nptl/pthread_kill.c:78:10
    #2 0x7817bdc9eb2c in pthread_kill nptl/./nptl/pthread_kill.c:89:10
    #3 0x7817bdc4527d in raise signal/../sysdeps/posix/raise.c:26:13
    #4 0x7817be2d2a7a in __gmp_exception (/lib/x86_64-linux-gnu/libgmp.so.10+0xaa7a)
    #5 0x7817be2d2ad1 in __gmp_overflow_in_mpz (/lib/x86_64-linux-gnu/libgmp.so.10+0xaad1)
    #6 0x7817be2e4184 in __gmpz_realloc (/lib/x86_64-linux-gnu/libgmp.so.10+0x1c184)
    #7 0x7817be2ecaf8 in __gmpz_n_pow_ui (/lib/x86_64-linux-gnu/libgmp.so.10+0x24af8)
    #8 0x15ca08d in zif_gmp_pow /home/arshid/Downloads/php-src/ext/gmp/gmp.c:1140:2
    #9 0x5fecc7e in ZEND_DO_ICALL_SPEC_RETVAL_UNUSED_HANDLER /home/arshid/Downloads/php-src/Zend/zend_vm_execute.h:1322:2
    #10 0x5b7d6ab in execute_ex /home/arshid/Downloads/php-src/Zend/zend_vm_execute.h:110228:12
    #11 0x5b7fbd3 in zend_execute /home/arshid/Downloads/php-src/Zend/zend_vm_execute.h:115646:2
    #12 0x6872cd9 in zend_execute_script /home/arshid/Downloads/php-src/Zend/zend.c:1972:3
    #13 0x50ca48a in php_execute_script_ex /home/arshid/Downloads/php-src/main/main.c:2655:13
    #14 0x50cb9c8 in php_execute_script /home/arshid/Downloads/php-src/main/main.c:2695:9
    #15 0x6886cd2 in do_cli /home/arshid/Downloads/php-src/sapi/cli/php_cli.c:947:5
    #16 0x688117f in main /home/arshid/Downloads/php-src/sapi/cli/php_cli.c:1370:18
    #17 0x7817bdc2a1c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #18 0x7817bdc2a28a in __libc_start_main csu/../csu/libc-start.c:360:3
    #19 0x606404 in _start (/home/arshid/Downloads/php-src/sapi/cli/php+0x606404)

But I expected this output instead:

Fatal error: Uncaught ValueError: gmp_pow(): Argument #2 ($exponent) must be between 0 and 1000000 in /Users/arshid/Downloads/php-src/z.php:2
Stack trace:
#0 /Users/arshid/Downloads/php-src/z.php(2): gmp_pow(2, 9223372036854775807)

PHP Version

PHP 8.6.0-dev (cli) (built: Jun 17 2026 11:10:33) (NTS DEBUG) Copyright © The PHP Group and Contributors Zend Engine v4.6.0-dev, Copyright © Zend by Perforce     with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce

Operating System

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions