1--TEST-- 2GH-16262 Stack buffer overflow in ext/bcmath/libbcmath/src/div.c:459 3--EXTENSIONS-- 4bcmath 5--INI-- 6bcmath.scale=0 7--FILE-- 8<?php 9$scales = [ 10 null, 11 0, 12 1, 13 2, 14 3, 15 4, 16 5, 17]; 18foreach ($scales as $scale) { 19 echo '========== scale: ', $scale ?? 'null', " ==========\n"; 20 echo "1 / 1000:\n"; 21 var_dump( 22 bcdiv('1', '1000', $scale), 23 (new BcMath\Number('1'))->div('1000', $scale), 24 ); 25 echo "1 / 2000:\n"; 26 var_dump( 27 bcdiv('1', '2000', $scale), 28 (new BcMath\Number('1'))->div('2000', $scale), 29 ); 30 echo "\n"; 31} 32?> 33--EXPECT-- 34========== scale: null ========== 351 / 1000: 36string(1) "0" 37object(BcMath\Number)#2 (2) { 38 ["value"]=> 39 string(5) "0.001" 40 ["scale"]=> 41 int(3) 42} 431 / 2000: 44string(1) "0" 45object(BcMath\Number)#1 (2) { 46 ["value"]=> 47 string(6) "0.0005" 48 ["scale"]=> 49 int(4) 50} 51 52========== scale: 0 ========== 531 / 1000: 54string(1) "0" 55object(BcMath\Number)#2 (2) { 56 ["value"]=> 57 string(1) "0" 58 ["scale"]=> 59 int(0) 60} 611 / 2000: 62string(1) "0" 63object(BcMath\Number)#1 (2) { 64 ["value"]=> 65 string(1) "0" 66 ["scale"]=> 67 int(0) 68} 69 70========== scale: 1 ========== 711 / 1000: 72string(3) "0.0" 73object(BcMath\Number)#2 (2) { 74 ["value"]=> 75 string(3) "0.0" 76 ["scale"]=> 77 int(1) 78} 791 / 2000: 80string(3) "0.0" 81object(BcMath\Number)#1 (2) { 82 ["value"]=> 83 string(3) "0.0" 84 ["scale"]=> 85 int(1) 86} 87 88========== scale: 2 ========== 891 / 1000: 90string(4) "0.00" 91object(BcMath\Number)#2 (2) { 92 ["value"]=> 93 string(4) "0.00" 94 ["scale"]=> 95 int(2) 96} 971 / 2000: 98string(4) "0.00" 99object(BcMath\Number)#1 (2) { 100 ["value"]=> 101 string(4) "0.00" 102 ["scale"]=> 103 int(2) 104} 105 106========== scale: 3 ========== 1071 / 1000: 108string(5) "0.001" 109object(BcMath\Number)#2 (2) { 110 ["value"]=> 111 string(5) "0.001" 112 ["scale"]=> 113 int(3) 114} 1151 / 2000: 116string(5) "0.000" 117object(BcMath\Number)#1 (2) { 118 ["value"]=> 119 string(5) "0.000" 120 ["scale"]=> 121 int(3) 122} 123 124========== scale: 4 ========== 1251 / 1000: 126string(6) "0.0010" 127object(BcMath\Number)#2 (2) { 128 ["value"]=> 129 string(6) "0.0010" 130 ["scale"]=> 131 int(4) 132} 1331 / 2000: 134string(6) "0.0005" 135object(BcMath\Number)#1 (2) { 136 ["value"]=> 137 string(6) "0.0005" 138 ["scale"]=> 139 int(4) 140} 141 142========== scale: 5 ========== 1431 / 1000: 144string(7) "0.00100" 145object(BcMath\Number)#2 (2) { 146 ["value"]=> 147 string(7) "0.00100" 148 ["scale"]=> 149 int(5) 150} 1511 / 2000: 152string(7) "0.00050" 153object(BcMath\Number)#1 (2) { 154 ["value"]=> 155 string(7) "0.00050" 156 ["scale"]=> 157 int(5) 158} 159