ext/gmp: gmp_pow fix FPE with large values. #16384

devnexen · 2024-10-12T06:16:51Z

even without sanitizers, it is reproducible but with the following

<?php
$g = gmp_init(256);
var_dump(gmp_pow($g, PHP_INT_MAX));

we get this

AddressSanitizer:DEADLYSIGNAL
=================================================================
==286922==ERROR: AddressSanitizer: FPE on unknown address 0x03e8000460ca (pc 0x7faf6c69de5c bp 0x400000000000004 sp 0x7ffe9843c740 T0)
    #0 0x7faf6c69de5c in __pthread_kill_implementation nptl/pthread_kill.c:44
    #1 0x7faf6c649c81 in __GI_raise ../sysdeps/posix/raise.c:26
    #2 0x7faf6db9386c in __gmp_exception (/lib/x86_64-linux-gnu/libgmp.so.10+0xd86c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #3 0x7faf6db938d3 in __gmp_overflow_in_mpz (/lib/x86_64-linux-gnu/libgmp.so.10+0xd8d3) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #4 0x7faf6dbac95c in __gmpz_realloc (/lib/x86_64-linux-gnu/libgmp.so.10+0x2695c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #5 0x7faf6dba9038 in __gmpz_n_pow_ui (/lib/x86_64-linux-gnu/libgmp.so.10+0x23038) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38)
    #6 0x5565ae1ccd9f in zif_gmp_pow /home/dcarlier/Contribs/php-src/ext/gmp/gmp.c:1286
    #7 0x5565aee96ea9 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:1312
    #8 0x5565af144320 in execute_ex /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:56075
    #9 0x5565af160f07 in zend_execute /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:60439
    #10 0x5565aed6fafe in zend_execute_scripts /home/dcarlier/Contribs/php-src/Zend/zend.c:1842
    #11 0x5565aeae70a8 in php_execute_script /home/dcarlier/Contribs/php-src/main/main.c:2578
    #12 0x5565af532f4e in do_cli /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:964
    #13 0x5565af535877 in main /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1334
    #14 0x7faf6c633d67 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #15 0x7faf6c633e24 in __libc_start_main_impl ../csu/libc-start.c:360
    #16 0x5565adc04040 in _start (/home/dcarlier/Contribs/php-src/sapi/cli/php+0x2604040) (BuildId: 949049955bdf8b7197390b1978a1dfc3ef6fdf38)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: FPE nptl/pthread_kill.c:44 in __pthread_kill_implementation
==286922==ABORTING

Girgias · 2024-10-12T10:52:01Z

ext/gmp/gmp.c

 	if (Z_TYPE_P(base_arg) == IS_LONG && Z_LVAL_P(base_arg) >= 0) {
 		INIT_GMP_RETVAL(gmpnum_result);
+		if ((log10(Z_LVAL_P(base_arg)) * exp) > (double)ULONG_MAX) {
+			zend_value_error("base and exponent overflow");
+			RETURN_THROWS();
+		}
 		mpz_ui_pow_ui(gmpnum_result, Z_LVAL_P(base_arg), exp);
 	} else {
 		mpz_ptr gmpnum_base;
+		unsigned long gmpnum;
 		FETCH_GMP_ZVAL(gmpnum_base, base_arg, temp_base, 1);
 		INIT_GMP_RETVAL(gmpnum_result);
+		gmpnum = mpz_get_ui(gmpnum_base);
+		if ((log10(gmpnum) * exp) > (double)ULONG_MAX) {
+			FREE_GMP_TEMP(temp_base);
+			zend_value_error("base and exponent overflow");
+			RETURN_THROWS();
+		}
 		mpz_pow_ui(gmpnum_result, gmpnum_base, exp);
 		FREE_GMP_TEMP(temp_base);
 	}


Maybe we should instead turn the int argument into mpz_t and use mpz_powm for cases where the integer is greater than an unsigned int?

Girgias

Thank you, looks simpler and cleaner :D

nielsdos · 2024-10-16T16:40:58Z

ext/gmp/gmp.c

+			mpz_init(mod);
+			mpz_set_si(base_num, Z_LVAL_P(base_arg));
+			mpz_set_si(exp_num, exp);
+			mpz_set_ui(mod, UINT_MAX);


Why compute the power modulo UINT_MAX ?

seems large enough and works for both 32/64. What do you have in mind ?

I just don't understand why you need to take a modulo. Would this not give the wrong result for e.g. base=2 exp=INT_MAX ?

It is more to put a "threshold", originally I implemented an exception.

My point is that

var_dump(gmp_pow(2, 2**31));

now outputs

object(GMP)#1 (1) { ["num"]=> string(1) "1" }

which is wrong.

I rather have an exception than a wrong result.

I know it s wrong :) @Girgias what do you think if I go back to my original idea ?

Right, mpz does not have a mpz_pow function, which is kinda strange. Throwing an exception is indeed better.

cmb69 · 2024-10-21T11:06:56Z

ext/gmp/gmp.c

-			mpz_clear(exp_num);
-		} else {
-			mpz_pow_ui(gmpnum_result, gmpnum_base, exp);
+		gmpnum = mpz_get_ui(gmpnum_base);


This can overflow; e.g. gmp_pow(gmp_init(PHP_INT_MAX), 256) is sufficient for overflow on x64 Windows; on LP64, gmp_pow(gmp_add(gmp_mul(gmp_init(PHP_INT_MAX), gmp_init(PHP_INT_MAX)), 3), 256) is likely to overflow here.

It seems to me that the libgmp/mpir developers where so focused to make it fast, that they forgot to make it right.

I ll add those two cases, the latter does not crash on linux/64 locally.

The problem is that mpz_get_ui() returns unsigned long long int (at least on Windows) which is an unsigned 64bit value. If you assign that to an unsigned long, the value will be truncated (well-defined behavior, but likely not desired here). It might be better to declare mpir_ui gmpnum, and then go from there, but that might cause further issues down the line.

cmb69

Sorry that I can't be more constructive here, but I barely understand the libraries, and how we're using them.

And it still seems to me that the question should not be "how can we avoid abort when calling libgmp/mpir", but rather "how can we avoid calling libgmp/mpir". ;)

cmb69 · 2024-10-23T19:30:34Z

ext/gmp/gmp.c

-			mpz_clear(exp_num);
-		} else {
-			mpz_pow_ui(gmpnum_result, gmpnum_base, exp);
+		gmpnum = mpz_get_ui(gmpnum_base);


The problem is that mpz_get_ui() returns unsigned long long int (at least on Windows) which is an unsigned 64bit value. If you assign that to an unsigned long, the value will be truncated (well-defined behavior, but likely not desired here). It might be better to declare mpir_ui gmpnum, and then go from there, but that might cause further issues down the line.

cmb69 · 2024-10-23T19:38:58Z

ext/gmp/gmp.c

-			mpz_clear(base_num);
-		} else {
-			mpz_ui_pow_ui(gmpnum_result, Z_LVAL_P(base_arg), exp);
+		if ((log10(Z_LVAL_P(base_arg)) * exp) > (double)ULONG_MAX) {


ULONG_MAX is only ~~2.147.483.647~~ 4294967295 on LLP64 (e.g. Windows 64bit). So that might constrain the range of allowed values too much. On the hand, on 32bit Windows that almost certainly can trigger OOM (e.g. 10 ** PHP_INT_MAX).

It might be better to declare mpir_ui gmpnum, and then go from there, but that might cause further issues down the line.

Note that the mpir_ui type does not exist in gmp (mpir lib ?). unsigned long int might be appropriate however.

Oh, of course; mpir_ui is an mpir type. unsigned long int is the same as unsigned long. We can probably use zend_ulong.

Sorry yes I missed this The problem is that mpz_get_ui() returns unsigned long long int (at least on Windows)

even without sanitizers, it is reproducible but with the following ``` <?php $g = gmp_init(256); var_dump(gmp_pow($g, PHP_INT_MAX)); ``` we get this ``` AddressSanitizer:DEADLYSIGNAL ================================================================= ==286922==ERROR: AddressSanitizer: FPE on unknown address 0x03e8000460ca (pc 0x7faf6c69de5c bp 0x400000000000004 sp 0x7ffe9843c740 T0) #0 0x7faf6c69de5c in __pthread_kill_implementation nptl/pthread_kill.c:44 #1 0x7faf6c649c81 in __GI_raise ../sysdeps/posix/raise.c:26 php#2 0x7faf6db9386c in __gmp_exception (/lib/x86_64-linux-gnu/libgmp.so.10+0xd86c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38) php#3 0x7faf6db938d3 in __gmp_overflow_in_mpz (/lib/x86_64-linux-gnu/libgmp.so.10+0xd8d3) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38) php#4 0x7faf6dbac95c in __gmpz_realloc (/lib/x86_64-linux-gnu/libgmp.so.10+0x2695c) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38) php#5 0x7faf6dba9038 in __gmpz_n_pow_ui (/lib/x86_64-linux-gnu/libgmp.so.10+0x23038) (BuildId: 1af68a49fe041a5bb48a2915c3d47541f713bb38) php#6 0x5565ae1ccd9f in zif_gmp_pow /home/dcarlier/Contribs/php-src/ext/gmp/gmp.c:1286 php#7 0x5565aee96ea9 in ZEND_DO_ICALL_SPEC_RETVAL_USED_HANDLER /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:1312 php#8 0x5565af144320 in execute_ex /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:56075 php#9 0x5565af160f07 in zend_execute /home/dcarlier/Contribs/php-src/Zend/zend_vm_execute.h:60439 php#10 0x5565aed6fafe in zend_execute_scripts /home/dcarlier/Contribs/php-src/Zend/zend.c:1842 php#11 0x5565aeae70a8 in php_execute_script /home/dcarlier/Contribs/php-src/main/main.c:2578 php#12 0x5565af532f4e in do_cli /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:964 php#13 0x5565af535877 in main /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1334 php#14 0x7faf6c633d67 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 php#15 0x7faf6c633e24 in __libc_start_main_impl ../csu/libc-start.c:360 php#16 0x5565adc04040 in _start (/home/dcarlier/Contribs/php-src/sapi/cli/php+0x2604040) (BuildId: 949049955bdf8b7197390b1978a1dfc3ef6fdf38) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: FPE nptl/pthread_kill.c:44 in __pthread_kill_implementation ==286922==ABORTING ```

cmb69

I guess that is as good as possible.

note: using consistent "style" for test on purpose.

github-actions bot added the Extension: gmp label Oct 12, 2024

devnexen marked this pull request as ready for review October 12, 2024 06:57

devnexen requested a review from Girgias as a code owner October 12, 2024 06:57

devnexen force-pushed the gmp_pow_fpe branch from abf5fbb to 972f582 Compare October 12, 2024 07:06

Girgias reviewed Oct 12, 2024

View reviewed changes

devnexen force-pushed the gmp_pow_fpe branch from 0389004 to 34f0afe Compare October 12, 2024 14:36

devnexen marked this pull request as draft October 12, 2024 15:13

devnexen force-pushed the gmp_pow_fpe branch from 34f0afe to 0973413 Compare October 12, 2024 15:27

devnexen marked this pull request as ready for review October 12, 2024 17:27

Girgias approved these changes Oct 13, 2024

View reviewed changes

nielsdos reviewed Oct 16, 2024

View reviewed changes

devnexen force-pushed the gmp_pow_fpe branch 2 times, most recently from 972f582 to 9282503 Compare October 17, 2024 17:43

devnexen mentioned this pull request Oct 19, 2024

Unexpected result of gmp_pow with huge exponent #16500

Closed

devnexen requested a review from Girgias October 20, 2024 20:57

cmb69 reviewed Oct 21, 2024

View reviewed changes

devnexen marked this pull request as draft October 21, 2024 14:39

devnexen force-pushed the gmp_pow_fpe branch from 9282503 to adb58f6 Compare October 21, 2024 14:40

devnexen marked this pull request as ready for review October 21, 2024 16:53

devnexen requested a review from cmb69 October 23, 2024 18:33

cmb69 reviewed Oct 23, 2024

View reviewed changes

devnexen added 3 commits October 24, 2024 20:16

add test

e2b07d7

add tests

3534f0a

devnexen marked this pull request as draft October 24, 2024 19:52

devnexen force-pushed the gmp_pow_fpe branch from adb58f6 to 0f893ea Compare October 24, 2024 19:53

change comparison limit, now new tests overflow on 64 bits.

72b5653

devnexen force-pushed the gmp_pow_fpe branch from 0f893ea to 72b5653 Compare October 24, 2024 20:00

zend_ulong

7f432a1

cmb69 approved these changes Oct 25, 2024

View reviewed changes

fix tests on 32 bits attempt.

752627d

note: using consistent "style" for test on purpose.

devnexen force-pushed the gmp_pow_fpe branch from 1ef87ac to 752627d Compare October 25, 2024 12:29

devnexen closed this in e0a0e21 Oct 25, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ext/gmp: gmp_pow fix FPE with large values. #16384

ext/gmp: gmp_pow fix FPE with large values. #16384

devnexen commented Oct 12, 2024

Girgias Oct 12, 2024

Girgias left a comment

nielsdos Oct 16, 2024

devnexen Oct 16, 2024

nielsdos Oct 16, 2024

devnexen Oct 16, 2024

nielsdos Oct 16, 2024

devnexen Oct 16, 2024 •

edited

Loading

Girgias Oct 17, 2024

cmb69 Oct 21, 2024

devnexen Oct 21, 2024

cmb69 Oct 23, 2024

cmb69 left a comment

cmb69 Oct 23, 2024

cmb69 Oct 23, 2024 •

edited

Loading

devnexen Oct 24, 2024 •

edited

Loading

cmb69 Oct 24, 2024

devnexen Oct 25, 2024

cmb69 left a comment

ext/gmp: gmp_pow fix FPE with large values. #16384

ext/gmp: gmp_pow fix FPE with large values. #16384

Conversation

devnexen commented Oct 12, 2024

Choose a reason for hiding this comment

Girgias left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

devnexen Oct 16, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cmb69 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cmb69 Oct 23, 2024 • edited Loading

Choose a reason for hiding this comment

devnexen Oct 24, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cmb69 left a comment

Choose a reason for hiding this comment

devnexen Oct 16, 2024 •

edited

Loading

cmb69 Oct 23, 2024 •

edited

Loading

devnexen Oct 24, 2024 •

edited

Loading