Summary
BigNumber::of() accepts scientific notation and expands positive exponents into the unscaled integer representation. A small untrusted input can therefore cause a very large allocation.
Reproduction
BigNumber::of('1e1000000000');The parser expands the value with str_repeat('0', $zeros). Depending on the PHP memory limit, this can exhaust worker memory or terminate the process.
Impact
Applications that parse externally supplied values through BigNumber::of() can be exposed to input-amplification denial of service. Input-length limits alone do not mitigate this, because the triggering input can be very short.
Proposal
Add an opt-in bounded parsing API or parse context that can limit:
- Input length
- Absolute exponent
- Expanded digit count and/or resulting scale
For example, conceptually:
BigNumber::of(
'1e1000000000',
parseLimits: new NumberParseLimits(
maxInputLength: 256,
maxExponent: 1_000,
maxExpandedDigits: 10_000,
),
);The parser should throw NumberFormatException when a limit is exceeded.
An opt-in API preserves arbitrary-precision use cases while allowing HTTP, GraphQL, and CLI boundaries to safely parse untrusted input.
Workaround
Callers should reject exponent notation or independently bound exponent magnitude before calling BigNumber::of().
Reported against Brick Math 0.19.0.
Summary
BigNumber::of()accepts scientific notation and expands positive exponents into the unscaled integer representation. A small untrusted input can therefore cause a very large allocation.Reproduction
The parser expands the value with
str_repeat('0', $zeros). Depending on the PHP memory limit, this can exhaust worker memory or terminate the process.Impact
Applications that parse externally supplied values through
BigNumber::of()can be exposed to input-amplification denial of service. Input-length limits alone do not mitigate this, because the triggering input can be very short.Proposal
Add an opt-in bounded parsing API or parse context that can limit:
For example, conceptually:
The parser should throw
NumberFormatExceptionwhen a limit is exceeded.An opt-in API preserves arbitrary-precision use cases while allowing HTTP, GraphQL, and CLI boundaries to safely parse untrusted input.
Workaround
Callers should reject exponent notation or independently bound exponent magnitude before calling
BigNumber::of().Reported against Brick Math
0.19.0.