Signed integer overflow in ext/dom/nodelist.c

[YuanchengJiang]

Description

The following code:

<?php
define("MAX_64Bit", 9223372036854775807);
define("MAX_32Bit", 2147483647);
define("MIN_64Bit", -9223372036854775807 - 1);
define("MIN_32Bit", -2147483647 - 1);
$longVals = array(
MAX_64Bit, MIN_64Bit, MAX_32Bit, MIN_32Bit, MAX_64Bit - MAX_32Bit, MIN_64Bit - MIN_32Bit,
);
$fusion = $longVals;
$dom = Dom\XMLDocument::createFromString('<root><a/><b/><c/></root>');
$children = $dom->documentElement->childNodes;
foreach ($fusion as $value) {
try {
var_dump($children[$value] ? $children[$value]->nodeName : "N/A", isset($children[$value]), empty($children[$value]));
} catch (Error $e) {
}
}

Resulted in this output:

/php-src/ext/dom/nodelist.c:176:24: runtime error: signed integer overflow: 2147483647 - -1 cannot be represented in type 'int'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/dom/nodelist.c:176:24

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04