Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

range(9.9, '0') causes segmentation fault #13094

Closed
KidFlo opened this issue Jan 8, 2024 · 4 comments
Closed

range(9.9, '0') causes segmentation fault #13094

KidFlo opened this issue Jan 8, 2024 · 4 comments

Comments

@KidFlo
Copy link

KidFlo commented Jan 8, 2024

Description

Hi,

The following code:

<?php
var_dump(range(9.9, '0'));

Resulted in a SEGFAULT.

But I expected (something like) this output instead:

array(10) {
  [0]=>
  float(9.9)
  [1]=>
  float(8.9)
  [2]=>
  float(7.9)
  [3]=>
  float(6.9)
  [4]=>
  float(5.9)
  [5]=>
  float(4.9)
  [6]=>
  float(3.9000000000000004)
  [7]=>
  float(2.9000000000000004)
  [8]=>
  float(1.9000000000000004)
  [9]=>
  float(0.9000000000000004)
}

This might not be specific to Windows, since I was also able to reproduce it here : https://3v4l.org/qc6TF.
Anyway if you need me to dump more information, just ask (I may not respond immediately).

PHP Version

PHP 8.3.1

Operating System

Windows 11

@iluuu1994
Copy link
Member

Likely caused by the changes from #10826, so assigning to @Girgias.

@nielsdos
Copy link
Member

nielsdos commented Jan 8, 2024

Huh I had already started debugging this,
anyway the root cause is if (UNEXPECTED(start_type + end_type < 2*IS_STRING)) {
Comment says /* If one of the inputs is NOT a string */ but that's not true as in the example start_type is 5 and end_type is 7, which is 12, and 2*IS_STRING is also 12.
I'd just change it to if (UNEXPECTED(start_type != IS_STRING || end_type != IS_STRING)) { which is clearer and unlikely to be slower in practice. But deferring to Gina.

@iluuu1994
Copy link
Member

@nielsdos No worries, I doubt Gina will be mad ^^ In any case, it's good she's informed.

@Girgias
Copy link
Member

Girgias commented Jan 8, 2024

Erg I was trying to be smart and failed.

Can you PR the change @nielsdos so that you get proper credit?

nielsdos added a commit to nielsdos/php-src that referenced this issue Jan 9, 2024
`start_type + end_type < 2*IS_STRING` is not right, in this test case
the types are start_type==5 (IS_DOUBLE), end_type==7 (IS_ARRAY).
The IS_ARRAY type is a sentinel to disambiguate single-byte strings.
The path must be taken when one of the types is not a string nor a
single-byte string. Therefore, use < IS_STRING with an OR condition.
@nielsdos nielsdos linked a pull request Jan 9, 2024 that will close this issue
nielsdos added a commit that referenced this issue Jan 9, 2024
* PHP-8.3:
  Fix GH-13094: range(9.9, '0') causes segmentation fault
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants