PHP base_convert() Precision Loss Vulnerability

What it is

The PHP application uses the base_convert() function with large numbers, which can lead to precision loss due to floating-point limitations. This vulnerability can cause incorrect calculations, authentication bypasses, or data corruption when dealing with cryptographic tokens, user IDs, or financial calculations.

// Vulnerable: base_convert() with large numbers
function convertToken($hexToken) {
    // Dangerous: Precision loss with large hex values
    $decimalToken = base_convert($hexToken, 16, 10);
    
    // This may lose precision for large tokens
    return $decimalToken;
}

// Example with user ID conversion
function generateUserId($sessionId) {
    $hexId = hash('sha256', $sessionId);
    
    // Dangerous: Large hash converted to decimal loses precision
    $numericId = base_convert(substr($hexId, 0, 15), 16, 10);
    
    return $numericId;
}

$userId = generateUserId($_SESSION['id']); // May have collisions

// Secure: Using BCMath for precise conversions
function convertTokenSafe($hexToken) {
    // Validate input
    if (!ctype_xdigit($hexToken)) {
        throw new InvalidArgumentException('Invalid hexadecimal token');
    }
    
    // Use BCMath for arbitrary precision
    $decimal = '0';
    $base = '1';
    
    for ($i = strlen($hexToken) - 1; $i >= 0; $i--) {
        $digit = hexdec($hexToken[$i]);
        $decimal = bcadd($decimal, bcmul($digit, $base));
        $base = bcmul($base, '16');
    }
    
    return $decimal;
}

// Alternative: Use GMP extension
function convertTokenGMP($hexToken) {
    if (!ctype_xdigit($hexToken)) {
        throw new InvalidArgumentException('Invalid hexadecimal token');
    }
    
    // GMP handles arbitrary precision
    return gmp_strval(gmp_init($hexToken, 16), 10);
}

// Secure user ID generation
function generateUserIdSafe($sessionId) {
    $hexId = hash('sha256', $sessionId);
    
    // Use first 8 bytes (16 hex chars) to stay within safe range
    $safeHex = substr($hexId, 0, 16);
    
    // Convert using built-in functions for safe range
    return hexdec($safeHex);
}

try {
    $userId = generateUserIdSafe($_SESSION['id']);
} catch (Exception $e) {
    error_log('User ID generation failed: ' . $e->getMessage());
    $userId = null;
}

Why it happens

PHP applications call base_convert() to convert large numeric strings between bases (hexadecimal to decimal, base64 to decimal) without considering PHP's integer precision limits. The base_convert() function internally uses floating-point arithmetic for calculations when numbers exceed PHP_INT_MAX (typically 2^63-1 on 64-bit systems or 2^31-1 on 32-bit systems). When converting values like base_convert('FFFFFFFFFFFFFFFF', 16, 10) (16 F's representing a 64-bit value), PHP promotes the calculation to floating-point (double precision) which has only 53 bits of mantissa precision per IEEE 754 standard. This causes the least significant bits to be rounded or lost, producing incorrect results. A typical vulnerable pattern converts cryptographic hash outputs to decimal: $hashValue = base_convert(hash('sha256', $data), 16, 10), where SHA-256's 256-bit output far exceeds floating-point precision, resulting in a value that appears numeric but has lost significant precision, creating security issues in comparisons, authentication tokens, or unique identifiers where collisions become possible due to multiple different inputs producing identical truncated output.

Fixes

Related Vulnerabilities