UBSan abort in ext/mbstring/mbstring.c:2343

[YuanchengJiang]

Description

The following code:

<?php
for ($i = -60; $i <= 60; $i += PHP_INT_MIN) {
$b = mb_substr($string_mb, $i, 4, 'UTF-8');
}

Resulted in this output:

/php-src/ext/mbstring/mbstring.c:2343:13: runtime error: negation of -9223372036854775808 cannot be represented in type 'zend_long' (aka 'long'); cast to an unsigned type to negate this value to itself
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/mbstring/mbstring.c:2343:13

PHP Version

nightly

Operating System

ubuntu 22.04

[devnexen]

happens not only with start but length argument as well.

[alexdowad]

Excellent catch, @YuanchengJiang.