# Write out-of-bounds at number_format

Integer overflow in PHP number_format() with huge decimals/dec_point length causes heap out-of-bounds write via topad loop.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2017-02-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/175310
- Library page: https://bugbountylibrary.com/r/h1%3A175310
- Tags: domain:oss kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:dos vuln:memory-corruption

**Target:** number_format() in ext/standard/math.c
**Root cause:** reslen is a signed int; adding dec (0x7fffffff) overflows to negative, so the padding loop topad runs with a huge positive count and writes '0' out of bounds.
**Steps:**
1. Call `number_format($d, 0x7fffffff, str_repeat('/', 0x7fffffff), ',')`
2. Observe reslen += dec overflows to negative at math.c:1168
3. topad becomes ~2147483329, while(topad--) writes '0' past buffer
**How found:** Code review of math.c length arithmetic; set breakpoints to watch reslen and topad under ASAN.
**Insight:** Audit integer length accumulators in C string builders for signed overflow when attacker controls a length parameter; watch for negative reslen feeding a padding loop.