diff --git a/ext/gmp/gmp.c b/ext/gmp/gmp.c index b5451b8035e37..e0b64e8dfed5c 100644 --- a/ext/gmp/gmp.c +++ b/ext/gmp/gmp.c @@ -372,6 +372,15 @@ static zend_result shift_operator_helper(gmp_binary_ui_op_t op, zval *return_val goto typeof_op_failure; } + if (shift > INT_MAX / 1000) { + zend_throw_error( + zend_ce_value_error, "%s must be less than %d", + opcode == ZEND_POW ? "Exponent" : "Shift", + (INT_MAX / 1000) + ); + ZVAL_UNDEF(return_value); + return FAILURE; + } INIT_GMP_RETVAL(gmpnum_result); op(gmpnum_result, gmpnum_op, (gmp_ulong) shift); return SUCCESS; diff --git a/ext/gmp/tests/bug16502.phpt b/ext/gmp/tests/bug16502.phpt new file mode 100644 index 0000000000000..965405cff5256 --- /dev/null +++ b/ext/gmp/tests/bug16502.phpt @@ -0,0 +1,17 @@ +--TEST-- +pow() with GMP exponent too large should throw ValueError +--EXTENSIONS-- +gmp +--FILE-- +getMessage(), "\n"; +} +?> +--EXPECTREGEX-- +Exponent must be less than [0-9]+ \ No newline at end of file