com php-src: Fixed uint32_t overflow: ext/opcache/z end_accelerator_util_funcs.c ext/opcache/zend_persi st.c ext/opcache/zend_persist_calc.c

Commit: 9a05f2dad2a47b9367d46083377b4dca63bacc75 Author: Dmitry Stogov <dmitry@zend.com> Tue, 26 Aug 2014 15:57:19 +0400 Parents: b63ab83256868db44eecedde319a4c2a27a5a10f Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=9a05f2dad2a47b9367d46083377b4dca63bacc75 Log: Fixed uint32_t overflow Changed paths: M ext/opcache/zend_accelerator_util_funcs.c M ext/opcache/zend_persist.c M ext/opcache/zend_persist_calc.c Diff: diff --git a/ext/opcache/zend_accelerator_util_funcs.c b/ext/opcache/zend_accelerator_util_funcs.c index f855477..e04b1ec 100644 --- a/ext/opcache/zend_accelerator_util_funcs.c +++ b/ext/opcache/zend_accelerator_util_funcs.c @@ -317,7 +317,7 @@ static zend_ast *zend_ast_clone(zend_ast *ast TSRMLS_DC) } else if (zend_ast_is_list(ast)) { zend_ast_list *list = zend_ast_get_list(ast); zend_ast_list *copy = emalloc( - sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1)); + sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children); copy->kind = list->kind; copy->attr = list->attr; copy->children = list->children; @@ -331,7 +331,7 @@ static zend_ast *zend_ast_clone(zend_ast *ast TSRMLS_DC) return (zend_ast *) copy; } else { uint32_t children = zend_ast_get_num_children(ast); - zend_ast *copy = emalloc(sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1)); + zend_ast *copy = emalloc(sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children); copy->kind = ast->kind; copy->attr = ast->attr; for (i = 0; i < children; i++) { diff --git a/ext/opcache/zend_persist.c b/ext/opcache/zend_persist.c index 5e29074..b49f28f 100644 --- a/ext/opcache/zend_persist.c +++ b/ext/opcache/zend_persist.c @@ -154,7 +154,7 @@ static zend_ast *zend_persist_ast(zend_ast *ast TSRMLS_DC) } else if (zend_ast_is_list(ast)) { zend_ast_list *list = zend_ast_get_list(ast); zend_ast_list *copy = zend_accel_memdup(ast, - sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1)); + sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children); for (i = 0; i < list->children; i++) { if (copy->child[i]) { copy->child[i] = zend_persist_ast(copy->child[i] TSRMLS_CC); @@ -163,7 +163,7 @@ static zend_ast *zend_persist_ast(zend_ast *ast TSRMLS_DC) node = (zend_ast *) copy; } else { uint32_t children = zend_ast_get_num_children(ast); - node = zend_accel_memdup(ast, sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1)); + node = zend_accel_memdup(ast, sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children); for (i = 0; i < children; i++) { if (node->child[i]) { node->child[i] = zend_persist_ast(node->child[i] TSRMLS_CC); diff --git a/ext/opcache/zend_persist_calc.c b/ext/opcache/zend_persist_calc.c index 9891951..76d1b04 100644 --- a/ext/opcache/zend_persist_calc.c +++ b/ext/opcache/zend_persist_calc.c @@ -91,7 +91,7 @@ static uint zend_persist_ast_calc(zend_ast *ast TSRMLS_DC) ADD_SIZE(zend_persist_zval_calc(zend_ast_get_zval(ast) TSRMLS_CC)); } else if (zend_ast_is_list(ast)) { zend_ast_list *list = zend_ast_get_list(ast); - ADD_SIZE(sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1)); + ADD_SIZE(sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children); for (i = 0; i < list->children; i++) { if (list->child[i]) { ADD_SIZE(zend_persist_ast_calc(list->child[i] TSRMLS_CC)); @@ -99,7 +99,7 @@ static uint zend_persist_ast_calc(zend_ast *ast TSRMLS_DC) } } else { uint32_t children = zend_ast_get_num_children(ast); - ADD_SIZE(sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1)); + ADD_SIZE(sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children); for (i = 0; i < children; i++) { if (ast->child[i]) { ADD_SIZE(zend_persist_ast_calc(ast->child[i] TSRMLS_CC));