Skip to content

saturate overflowing numeric string casts #84

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nvms merged 1 commit into from
Sep 15, 2026
Merged

saturate overflowing numeric string casts #84

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 25 additions & 1 deletion src/runtime/value.zig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1570,7 +1570,8 @@ pub const Value = union(enum) {
const f = parseLeadingFloat(s[start..]);
if (!std.math.isFinite(f)) return 0;
const max_f: f64 = 9.2233720368547758e18;
if (f >= max_f or f < -max_f) return 0;
if (f >= max_f) return std.math.maxInt(i64);
if (f <= -max_f) return std.math.minInt(i64);
return @intFromFloat(f);
}
// saturating parse: matches PHP's "(int)<numeric string>" which clamps
Expand Down Expand Up @@ -1980,6 +1981,29 @@ test "numeric string exponent requires digits" {
}
}

test "parse leading int float saturation" {
// positive overflow
try std.testing.expectEqual(std.math.maxInt(i64), Value.toInt(.{ .string = Value.String.borrowed("1e100") }));
try std.testing.expectEqual(std.math.maxInt(i64), Value.toInt(.{ .string = Value.String.borrowed("1e19") }));
try std.testing.expectEqual(std.math.maxInt(i64), Value.toInt(.{ .string = Value.String.borrowed("9.9e18") }));
try std.testing.expectEqual(std.math.maxInt(i64), Value.toInt(.{ .string = Value.String.borrowed("9.223372036854776e18") }));
try std.testing.expectEqual(std.math.maxInt(i64), Value.toInt(.{ .string = Value.String.borrowed("9223372036854775807.0") }));

// negative overflow
try std.testing.expectEqual(std.math.minInt(i64), Value.toInt(.{ .string = Value.String.borrowed("-1e100") }));
try std.testing.expectEqual(std.math.minInt(i64), Value.toInt(.{ .string = Value.String.borrowed("-1e19") }));
try std.testing.expectEqual(std.math.minInt(i64), Value.toInt(.{ .string = Value.String.borrowed("-9.9e18") }));
try std.testing.expectEqual(std.math.minInt(i64), Value.toInt(.{ .string = Value.String.borrowed("-9.223372036854776e18") }));
try std.testing.expectEqual(std.math.minInt(i64), Value.toInt(.{ .string = Value.String.borrowed("-9223372036854775808.0") }));

// boundary and in-range cases
try std.testing.expectEqual(@as(i64, 9223372036854774784), Value.toInt(.{ .string = Value.String.borrowed("9.223372036854775e18") }));
try std.testing.expectEqual(@as(i64, -9223372036854774784), Value.toInt(.{ .string = Value.String.borrowed("-9.223372036854775e18") }));
try std.testing.expectEqual(@as(i64, 100000), Value.toInt(.{ .string = Value.String.borrowed("1e5") }));
try std.testing.expectEqual(@as(i64, 123), Value.toInt(.{ .string = Value.String.borrowed("123.456") }));
try std.testing.expectEqual(@as(i64, -123), Value.toInt(.{ .string = Value.String.borrowed("-123.456") }));
}

test "truthiness" {
try std.testing.expect(!Value.isTruthy(.null));
try std.testing.expect(!Value.isTruthy(.{ .bool = false }));
Expand Down
24 changes: 24 additions & 0 deletions tests/numeric_string_int_saturation.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
<?php
// (int) cast and intval on numeric strings with float/exponent overflow clamp to PHP_INT_MAX / PHP_INT_MIN
var_dump((int)"1e100");
var_dump((int)"-1e100");
var_dump((int)"1e19");
var_dump((int)"-1e19");
var_dump((int)"9.9e18");
var_dump((int)"-9.9e18");
var_dump(intval("1e100"));
var_dump(intval("-1e100"));

// boundary values
var_dump((int)"9.223372036854776e18");
var_dump((int)"-9.223372036854776e18");
var_dump((int)"9223372036854775807.0");
var_dump((int)"-9223372036854775808.0");

// in-range float strings truncate toward zero
var_dump((int)"9.223372036854775e18");
var_dump((int)"-9.223372036854775e18");
var_dump((int)"1e5");
var_dump((int)"-1e5");
var_dump((int)"123.456");
var_dump((int)"-123.456");
Loading