Skip to content

Make uint32_t to zend_long conversion explicit in unpack() - #24258

Merged
ndossche merged 1 commit into
php:masterfrom
ushevchenko:issue-24257-unpack-uint32-cast
Oct 13, 2026
Merged

ndossche merged 1 commit into
php:masterfrom
ushevchenko:issue-24257-unpack-uint32-cast

Conversation

@ushevchenko

@ushevchenko ushevchenko commented Oct 11, 2026 •

Copy link
Copy Markdown
Contributor

Fixes #24257
Fix: SIGN_EXTENSION

Problem:
unpack() converts a uint32_t to zend_long implicitly for the L, N and V formats. On 32-bit builds this conversion is implementation-defined for values above INT32_MAX. The signed variant (l) in the same block already uses an explicit cast.

This change makes the conversion explicit. The returned values do not change on any platform, so no test was added.

The issue was identified by static analysis (Svace) and has not been reproduced at runtime on a 32-bit build.

Signed-off-by: Uliya Shevchenko u.shevchenko@fobos-nt.ru
Signed-off-by: Georgij Tsarin crystarm@altlinux.org

Problem:
In unpack(), a uint32_t value is implicitly converted to zend_long
for the L, N and V formats. On 32-bit builds values above INT32_MAX
may become negative; the conversion is implementation-defined.
Solution: add an explicit (zend_long) cast. The returned values do not
change on any platform.
Signed-off-by: Uliya Shevchenko <u.shevchenko@fobos-nt.ru>
Signed-off-by: Georgij Tsarin <crystarm@altlinux.org>
@ushevchenko
ushevchenko requested a review from bukka as a code owner October 11, 2026 09:50
@ushevchenko ushevchenko changed the title Make uint32_t to zend_long conversion explicit in unpack() Fix:SIGN_EXTENSION; Make uint32_t to zend_long conversion explicit in unpack() Oct 13, 2026
@ushevchenko ushevchenko changed the title Fix:SIGN_EXTENSION; Make uint32_t to zend_long conversion explicit in unpack() Make uint32_t to zend_long conversion explicit in unpack() Oct 13, 2026
@ndossche

Copy link
Copy Markdown
Member

I'm going to merge this to silence the static analyser, but indeed this isn't a bug, the conversion behaviour is fully defined in the manual.

@ndossche
ndossche merged commit f1b9b1a into php:master Oct 13, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Potential incorrect sign conversion of uint32_t to zend_long in unpack() on 32-bit builds (ext/standard/pack.c)

2 participants