Mine the Harvest

Today the above PHP bug was pointed out to me, and in looking into it further I discovered a few interesting things, which I’ve decided to list here.  While this bug is serious, a bit of research quickly showed it requires a rather specific combination of PHP version, OS architecture and CPU architecture and feature set, as well as PHP build options.

1) This is completely dependent on an x87 FPU design flaw, wherein 80-bit FP arithmetic is used.

2) Newer processors (x86-64)  with  SSE2 are IEEE-754 compliant, and use 64-bit FP.  So, even if you are running an affected version of PHP (5.3.x or 5.2.x) on a 32-bit OS, if you have an X86-64 CPU you may not in fact be affected (depending on how php was built). Test and see by running a simple test such as:

[user@host ~]$ cat phptest.php
<?php $d = 2.2250738585072011e-308; echo $d + 0; echo “\n”; ?>
[user@host ~]$ php phptest.php
2.2250738585072E-308

3) One work around, if you are affected, is to simple have php.ini preload a simple  script to detect to handle requests containing the problematic value, as described here.

4) Alternatively, if you wish to compile your own PHP, adding -mfpmath=sse (or -ffloat-store) to your CFLAGS will also resolve this issue.

While at first this bug may cause a sense that great effort will be needed on a sys admins part to update PHP on many servers, investigation and testing may show that little needs to be done. Of course, new packages for PHP 5.3 will soon be available with will correct the issue as well, but the above may assist you in assessing what actions may need to be taken in the interim.