# memcpy negative parameter _bc_new_num_ex

Integer overflow in PHP bcmath _bc_new_num_ex with scale=0x7fffffff makes memset receive a negative size, corrupting memory via bcadd/bcsub/bcsqrt.

- Payout: $500
- Severity: low
- Program: Internet Bug Bounty
- Credited: fms
- Disclosed: 2017-02-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/175312
- Library page: https://bugbountylibrary.com/r/h1%3A175312
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:php technique:source-review vuln:memory-corruption

**Target:** ext/bcmath libbcmath _bc_new_num_ex
**Root cause:** length+scale computed as signed int overflows when scale=0x7fffffff, producing -2147483648 passed as memset size.
**Steps:**
1. Call a bcmath function (bcadd/bcsub/bcsqrt) with scale parameter 0x7fffffff
2. Observe _bc_new_num_ex(length=1, scale=0x7fffffff)
3. memset(temp->n_ptr, 0, length+scale) receives 0xffffffff80000000 as size
4. Memory corruption occurs
**How found:** Code review of libbcmath init.c spotted length+scale in memset; GDB confirmed signed overflow to negative size.
**Insight:** Audit integer arithmetic on user-controlled scale/precision parameters in arbitrary-precision math libraries; signed overflow in size computations feeding memset/memcpy is a recurring bug class.