bcmul memory leak

[YuanchengJiang]

Description

The following code:

<?php
$timestamp = mktime(8, 8, 8, 8, 8, 2008);
bcmul($fusion,$fusion,$timestamp);

Resulted in this output:

==814951==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 40 byte(s) in 1 object(s) allocated from:
    #0 0x6807ed in malloc (/home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php+0x6807ed)
    #1 0x3ba8473 in __zend_malloc /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_alloc.c:3280:14
    #2 0xe4b4e0 in _bc_new_num_nonzeroed_ex_internal /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/bcmath/libbcmath/src/init.c:50:10
    #3 0xe4a3b3 in _bc_new_num_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/bcmath/libbcmath/src/init.c:64:16
    #4 0xe4bded in bc_init_numbers /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/bcmath/libbcmath/src/init.c:93:16
    #5 0xdfd0eb in zm_globals_ctor_bcmath /home/phpfuzz/WorkSpace/flowfusion/php-src/ext/bcmath/bcmath.c:105:2
    #6 0x3505234 in tsrm_update_active_threads /home/phpfuzz/WorkSpace/flowfusion/php-src/TSRM/TSRM.c:265:7
    #7 0x35042ba in ts_allocate_id /home/phpfuzz/WorkSpace/flowfusion/php-src/TSRM/TSRM.c:306:2
    #8 0x3bfc111 in zend_startup_module_ex /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.c:2421:3
    #9 0x3c01b5e in zend_startup_module_zval /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.c:2445:10
    #10 0x4833163 in zend_hash_apply /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_hash.c:2085:13
    #11 0x3c00d8b in zend_startup_modules /home/phpfuzz/WorkSpace/flowfusion/php-src/Zend/zend_API.c:2568:2
    #12 0x3537ba2 in php_module_startup /home/phpfuzz/WorkSpace/flowfusion/php-src/main/main.c:2289:2
    #13 0x4d5ae58 in php_cli_startup /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:397:9
    #14 0x4d50c79 in main /home/phpfuzz/WorkSpace/flowfusion/php-src/sapi/cli/php_cli.c:1280:6
    #15 0x7f54919ced8f in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16

SUMMARY: AddressSanitizer: 40 byte(s) leaked in 1 allocation(s).

PHP Version

nightly

Operating System

No response

[YuanchengJiang]

<?php
$x = 882858043;
bcpow($fusion,$fusion,$x);

[SakiTakamachi]

@YuanchengJiang
Sorry, I haven't been feeling well for a while.
What is the value of $fusion here?

[YuanchengJiang]

@SakiTakamachi it is an undefined variable.

[SakiTakamachi]

@YuanchengJiang

Thanks, I understand it.

This doesn't happen with the Number class, only with functions.
The memory exhaustion occurs when converting the resulting bc_num structure to string, and the Number class already has the argument bc_num structure free at this point, so it won't leak.

On the other hand, in the function, first and second are released after the line that actually performs string conversion, so a memory leak occurs here.

php-src/ext/bcmath/bcmath.c

Line 318 in 60ee42e

RETVAL_NEW_STR(bc_num2str_ex(result, scale));

edit:
This probably occurs in all previous versions.