ext/gmp: gmp_fact() reject values larger than unsigned long.

close GH-21794

Author: devnexen

NEWS

@@ -36,6 +36,9 @@ PHP                                                                        NEWS
   . imagesetstyle()/imagefilter()/imagecrop() check array argument entries
     types. (David Carlier)
 
+- GMP:
+  . gmp_fact() reject values larger than unsigned long. (David Carlier)
+
 - Hash:
   . Upgrade xxHash to 0.8.2. (timwolla)
 

UPGRADING

@@ -141,6 +141,10 @@ PHP 8.6 UPGRADE NOTES
 5. Changed Functions
 ========================================
 
+- GMP:
+  . gmp_fact() now throws a ValueError() if $num does not fit into
+    a unsigned long.
+
 - mysqli:
   . The return structure of mysqli_get_charset() no longer contains
     the undocumented "comment" element. The value of "charsetnr" is

ext/gmp/gmp.c

@@ -1092,8 +1092,10 @@ ZEND_FUNCTION(gmp_fact)
 		RETURN_THROWS();
 	}
 
-	// TODO: Check that we don't an int that is larger than an unsigned long?
-	// Could use mpz_fits_slong_p() if we revert to using mpz_get_si()
+	if (!mpz_fits_ulong_p(gmpnum)) {
+		zend_argument_value_error(1, "must be between 0 and %lu", ULONG_MAX);
+		RETURN_THROWS();
+	}
 
 	INIT_GMP_RETVAL(gmpnum_result);
 	mpz_fac_ui(gmpnum_result, mpz_get_ui(gmpnum));

ext/gmp/tests/gmp_fact_overflow.phpt

@@ -0,0 +1,25 @@
+--TEST--
+gmp_fact() rejects values larger than unsigned long
+--EXTENSIONS--
+gmp
+--FILE--
+<?php
+
+try {
+    var_dump(gmp_fact(gmp_pow(2, 100)));
+} catch (\ValueError $e) {
+    echo $e->getMessage() . \PHP_EOL;
+}
+
+try {
+    var_dump(gmp_fact(gmp_init("18446744073709551616")));
+} catch (\ValueError $e) {
+    echo $e->getMessage() . \PHP_EOL;
+}
+
+echo "Done\n";
+?>
+--EXPECTF--
+gmp_fact(): Argument #1 ($num) must be between 0 and %d
+gmp_fact(): Argument #1 ($num) must be between 0 and %d
+Done