Segmentation fault (access null pointer) in ext/bcmath/libbcmath/src/rmzero.c:50

[YuanchengJiang]

Description

The following code:

<?php
$values = ['12.5', '-12.5'];
$exponents = [
[new BcMath\Number('-2'), 'object'],
];
foreach ($values as $fusion) {
$num = new BcMath\Number($value);
foreach ($exponents as [$exponent, $type]) {
$ret = $num->pow($exponent);
}
}

Resulted in this output:

/php-src/ext/bcmath/libbcmath/src/rmzero.c:50:11: runtime error: member access within null pointer of type 'struct bc_struct'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /php-src/ext/bcmath/libbcmath/src/rmzero.c:50:11

PHP Version

PHP 8.4.0-dev

Operating System

ubuntu 22.04

[cmb69]

Simpler reproducer:

(new BcMath\Number("0"))->pow("-2");

If bc_raise() fails, it apparently doesn't change result, so this needs to be checked prior to dereferencing it.

Interestingly, https://3v4l.org/YmJUi https://3v4l.org/YmJUi/rfc#output

[cmb69]

If bc_raise() fails, it apparently doesn't change result, so this needs to be checked prior to dereferencing it.

Or bc_init_num() the variable to get the same doubtful result as with bcpow().

[SakiTakamachi]

Thank you for finding!
I resolved that, will open PR later.