number handling in php broken on 32bit system

[Alexander Kjäll]

Binary package hint: php5-cli

This program displays the error:

<?

printf("%u\n", ((1 << 31) - 1));

printf("%u\n", ((1 << 31) - 2));

printf("%u\n", ((1 << 31) - 3));

?>

On my 32bit machine it gives this output:
2147483648
2147483648
2147483648

and on my 64 bit this, same on my friends 32bit windows installaton:
2147483647
2147483646
2147483645

shifting a 1 31 steps shouldn't even overflow a 32bit variable, so there is something wrong here.

[Chuck Short (zulcss)]

Which version?

Thanks
chuck

[Alexander Kjäll (capitol)]

$ php --version
PHP 5.2.3-1ubuntu6.3 (cli) (built: Jan 10 2008 09:38:37)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies

[Russell Smith (mr-russ)]

My understanding is 64bit machines use 64bit integers, so 1 <<31 doesn't overflow on 64bit. However on 32bit is does overflow. Even though an unsigned integer is being printed, a signed integer is being calculated as shown below;

printf("%s\n", (1 << 31)); returns -2147483648

This suggests it's wrapped back to the other end of the signed loop.

I believe the issue is that you wrap a signed integer on 32bit, and then php doesn't get you back from the edge to give meaningful values. I don't have the php debugging skills to nail down the specific issue with integer wraparound. But that is certainly what's being experienced.

PHP Version
--
PHP 5.2.4-2ubuntu5 with Suhosin-Patch 0.9.6.2 (cli) (built: Feb 27 2008 20:43:54)
Copyright (c) 1997-2007 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2007 Zend Technologies