UndefinedBehaviorSanitizer crash in SQLite3 BLOB fseek(PHP_INT_MIN, SEEK_END)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start in ext/sqlite3/sqlite3.c at line 1193, using the supplied PHP script to reproduce the UndefinedBehaviorSanitizer failure. Check the fseek handling for PHP_INT_MIN with SEEK_END and add or update the relevant SQLite3 stream test so the call completes without undefined behavior and returns -1.
Written by the indexing model from the issue text.
Description
Description
The following code:
<?php
$db = new SQLite3(':memory:');
$db->exec('CREATE TABLE test (id TEXT, data BLOB)');
$stmt = $db->prepare('INSERT INTO test (id, data) VALUES (:id, :data)');
$stmt->bindValue(':id', 'a', SQLITE3_TEXT);
$stmt->bindValue(':data', 'TEST TEST', SQLITE3_BLOB);
$stmt->execute();
$row = $db->querySingle("SELECT data FROM test WHERE id='a'", true);
$stream = $db->openBlob('test', 'data', 1);
var_dump(fseek($stream, PHP_INT_MIN, SEEK_END));
Resulted in this output:
php-src/ext/sqlite3/sqlite3.c:1193:47: runtime error: negation of -9223372036854775808 cannot be represented in type 'zend_off_t' (aka 'long long'); cast to an unsigned type to negate this value to itself
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /Users/arshid/Downloads/php-src/ext/sqlite3/sqlite3.c:1193:47
[2] 88129 abort sapi/cli/php z.php
But I expected this output instead:
int(-1)
PHP Version
PHP 8.4.11 (cli) (built: Jul 29 2025 15:30:21) (NTS)
Copyright (c) The PHP Group
Built by Homebrew
Zend Engine v4.4.11, Copyright (c) Zend Technologies
with Xdebug v3.5.0, Copyright (c) 2002-2025, by Derick Rethans
with Zend OPcache v8.4.11, Copyright (c), by Zend Technologies
Operating System
No response
- Dominant language
- C
- Stars
- 40.4k
- Forks
- 8.2k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 112
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from php/php-src
-
Bug SAPI: cli_server Status: Verified
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Bug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Bug Status: Needs Triage
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Bug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Bug Category: Tests Status: Verified
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Similar issues
-
level/task module/gcp type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 1/5 Under an hour Newbie friendliness 86/100
hapostgres/pg_auto_failover#1190 ·
-
docs
Difficulty 1/5 Under an hour Newbie friendliness 85/100
-
P3 sonic-vpp
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
sonic-net/sonic-buildimage#29662 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 94/100
spack/spack-packages#6586 ·