Repository navigation
Regression: filter_var() FILTER_VALIDATE_INT accepts overflow string past PHP_INT_MAX (ext/filter/logical_filters.c) #17585
Description
Category
stdlib · php-src-strict
Problem
FILTER_VALIDATE_INT must reject decimal strings whose numeric value exceeds PHP_INT_MAX. Zend returns false; this compiler coerces/truncates and returns 9223372036854775807 (on 64-bit).
| Repro | Zend 8.2+ | VM (2026-07-10) |
|---|---|---|
filter_var(PHP_INT_MAX.'0', FILTER_VALIDATE_INT) |
false |
9223372036854775807 |
filter_var('0123', FILTER_VALIDATE_INT) |
false |
false (ok) |
php-src reference
- php/php-src
ext/filter/logical_filters.c—php_filter_validate_int()overflow check viaZEND_STRTOL/ range validation
PHP implementation target
ext/filter/VM implementation (PHP) — mirror Zend overflow rejection; share guards with any JIT lowering inlib/JIT/
Repro
./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_filter_validate_int_overflow.php'
# fail: overflow int validated as 9223372036854775807Done when
-
maintainer_gap_filter_validate_int_overflow.phpprintsokon VM/JIT/AOT - Compliance
.phptundertest/compliance/cases/stdlib/filter_validate_int_overflow.phpt - php-src-strict; no php-compiler-strict shortcut
Activity
PurHur commentedon Jul 10, 2026
claim: cursor-agent-lane-c — starting this run
Stdlib: reject FILTER_VALIDATE_INT overflow past PHP_INT_MAX (#17585) (…
PurHur commentedon Jul 10, 2026
Merged via #17593.
Fix:
parseDecimalIntegerString()inext/filter/VmFilter.php— decimal strings whose magnitude exceeds native int bounds now returnfalse(php-srcext/filter/logical_filters.cparity).PHP_INT_MINhandled as a direct edge case.Verification:
```bash
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && php bin/vm.php test/repro/maintainer_gap_filter_validate_int_overflow.php'
ok
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter VmFilterTest'
OK (42 tests)
./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter filter_validate_int_overflow'
OK (2 tests)
```
PurHur commentedon Jul 10, 2026
claim: PHP Runtime → PHP — starting this run (#17585 FILTER_VALIDATE_INT overflow rejection in ext/filter/VmFilter.php).