BCMath\Number operators may typecast operand

[cmb69]

Description

The following code:

<?php
class MyString {
    function __toString() {
        return "2";
    }
}

$a = new BCMath\Number("1");
$b = new MyString();
var_dump($a + $b, $b);

Resulted in this output:

object(BcMath\Number)#2 (2) {
  ["value"]=>
  string(1) "3"
  ["scale"]=>
  int(0)
}

string(1) "2"

But I expected this output instead:

object(BcMath\Number)#2 (2) {
  ["value"]=>
  string(1) "3"
  ["scale"]=>
  int(0)
}
object(MyString)#2 (0) {
}

Note that this even happens in strict typing mode, where it may not even be expected that the addition succeeds.

Anyhow, the problem is that zend_parse_arg_str_or_long_slow() converts the passed arg.

Also note that GMP also uses ZPP functionality, but catches any such type conversion, even in coercive typing mode.

PHP Version

PHP 8.4

Operating System

any

[cmb69]

Confirmed: https://3v4l.org/6g9B3/rfc#vgit.master

Somewhat different issue, but also related to bcmath_number_parse_num():

<?php declare(strict_types=0);
var_dump(new BCMath\Number("1") + null);

does not throw a deprecation warning, as it is supposed to, since the RFC states:

Calculations with the operator behave as if the corresponding method's optional arguments were not specified.

And for strict typing, the operation succeeds, but the method fails.

[iluuu1994]

/cc @SakiTakamachi

[Girgias]

Confirmed: https://3v4l.org/6g9B3/rfc#vgit.master

Somewhat different issue, but also related to bcmath_number_parse_num():

<?php declare(strict_types=0);
var_dump(new BCMath\Number("1") + null);

does not throw a deprecation warning, as it is supposed to, since the RFC states:

Calculations with the operator behave as if the corresponding method's optional arguments were not specified.

And for strict typing, the operation succeeds, but the method fails.

The null aspect should be "solved" by: #15875

[SakiTakamachi]

Thanks for finding this, I'll check it out later.

[Girgias]

Okay, I did some investigation on the GMP side why this is not an issue.

The reason is that convert_to_gmp() which does the ZPP parsing for GMP|string|int uses zend_parse_arg_long_slow() for the default case, and thus doesn't attempt to cast objects to strings.