Merge branch 'main' into dependabot/github_actions/shivammathur/setup-php-2.37.2

Author: nanasess

.github/workflows/ci.yml

@@ -97,7 +97,8 @@ jobs:
                 run: |
                   # scale_ini test skipped: bcmath.scale INI setting ignored without native extension
                   # gh20006 test skipped: requires BcMath\Number OOP API (not supported by polyfill)
-                  docker run --rm -v $PWD:/app bcmath-phpt-test:${{ matrix.php-version }} --skip bcdivmod,bug54598,bug72093,bug75178,gh15968,gh16262,scale_ini,bcmul_check_overflow,bug78878,bcpow_error1,bcpow_error2,bcpow_error3,bcpowmod_error,bcpowmod_with_mod_1,bcpowmod_zero_modulus,bcround_all,bcround_away_from_zero,bcround_ceiling,bcround_early_return,bcround_floor,bcround_toward_zero,bcscale_variation003,bcdivmod_by_zero,gh20006
+                  # bcround_precision_bounds test skipped: requires BcMath\Number OOP API (not supported by polyfill)
+                  docker run --rm -v $PWD:/app bcmath-phpt-test:${{ matrix.php-version }} --skip bcdivmod,bug54598,bug72093,bug75178,gh15968,gh16262,scale_ini,bcmul_check_overflow,bug78878,bcpow_error1,bcpow_error2,bcpow_error3,bcpowmod_error,bcpowmod_with_mod_1,bcpowmod_zero_modulus,bcround_all,bcround_away_from_zero,bcround_ceiling,bcround_early_return,bcround_floor,bcround_toward_zero,bcscale_variation003,bcdivmod_by_zero,gh20006,bcround_precision_bounds
         strategy:
             fail-fast: false
             matrix:

phpstan.neon.dist

@@ -42,6 +42,17 @@ parameters:
 			identifier: function.impossibleType
 			path: tests/BCMathTest.php
 			message: "#Call to function in_array\\(\\) with arguments RoundingMode, array\\{.*\\} and true will always evaluate to false\\.#"
+		# PHPStan binds `\RoundingMode` to Rector's scoped polyfill class (not an
+		# enum), so `enum_exists('RoundingMode')` is statically inferred as always
+		# false. At runtime our enum polyfill in lib/RoundingMode.php is the one in
+		# use, so these guards are legitimate. Same static-analysis artifact as above.
+		-
+			identifier: function.impossibleType
+			message: "#Call to function enum_exists\\(\\) with 'RoundingMode' will always evaluate to false\\.#"
+			paths:
+				- src/BCMath.php
+				- tests/BCMathTest.php
+				- tests/fixtures/clean-load.php
 		-
 			identifier: encapsedStringPart.nonString
 			path: tests/BCMathTest.php

src/BCMath.php

@@ -1012,6 +1012,16 @@ public static function ceil(string $num): string
      */
     public static function round(string $num, int $precision = 0, $mode = PHP_ROUND_HALF_UP): string
     {
+        // PHP's native bcround() (8.4+) rejects a $precision above INT_MAX before
+        // performing any computation. Without this guard a huge precision triggers
+        // an out-of-memory fatal via str_repeat() in bcroundHelper(). Mirror
+        // php-src's bcmath_check_precision(): only the upper bound overflows int.
+        if ($precision > 2147483647) {
+            throw new \ValueError(
+                'bcround(): Argument #2 ($precision) must be between '.PHP_INT_MIN.' and 2147483647'
+            );
+        }
+
         self::validateNumberString($num, 'bcround', 1, 'num');
 
         if (!is_numeric($num)) {

tests/BCMathTest.php

@@ -826,6 +826,43 @@ public function testRoundNegativeScale(): void
         }
     }
 
+    /**
+     * bcround() must reject a $precision above INT_MAX with a ValueError,
+     * mirroring PHP 8.4's native behaviour. Previously such values triggered
+     * an out-of-memory fatal via str_repeat() (php-src bcround_precision_bounds).
+     */
+    public function testRoundPrecisionAboveIntMaxThrows(): void
+    {
+        if (PHP_INT_SIZE !== 8) {
+            $this->markTestSkipped('Requires a 64-bit platform where PHP_INT_MAX exceeds INT_MAX.');
+        }
+
+        $expectedMessage = 'bcround(): Argument #2 ($precision) must be between '.PHP_INT_MIN.' and 2147483647';
+
+        foreach ([PHP_INT_MAX, 2147483648] as $precision) {
+            $caught = null;
+
+            try {
+                BCMath::round('1', $precision);
+            } catch (\ValueError $e) {
+                $caught = $e;
+            }
+            $this->assertInstanceOf(
+                \ValueError::class,
+                $caught,
+                "Expected ValueError for precision={$precision}"
+            );
+            $this->assertSame($expectedMessage, $caught->getMessage());
+        }
+
+        // Note: we intentionally do not cross-check against the native bcround(),
+        // because the precision bounds guard is a php-src master (8.6) addition and
+        // released bcmath (e.g. 8.5) still OOMs on such precision values.
+
+        // A normal in-range precision must still work and not be over-rejected.
+        $this->assertSame('1.00', BCMath::round('1', 2));
+    }
+
     /**
      * Test sqrt bug reproduction cases.
      *