com php-src: We should not silently go on if the required size can not be met.: Zend/zend_hash.c

Commit: d2bcdec980e31d876bdcc4cfb59392fdf215badb Author: Xinchen Hui <laruence@php.net> Wed, 12 Aug 2015 16:40:59 +0800 Parents: cbcacbb2dad4c97ba5653f42729f7956193d9112 Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d2bcdec980e31d876bdcc4cfb59392fdf215badb Log: We should not silently go on if the required size can not be met. Changed paths: M Zend/zend_hash.c Diff: diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c index 96ed679...b8cd435 100644 --- a/Zend/zend_hash.c +++ b/Zend/zend_hash.c @@ -98,6 +98,11 @@ static uint32_t zend_always_inline zend_hash_check_size(uint32_t nSize) /* Use big enough power of 2 */ /* size should be between HT_MIN_SIZE and HT_MAX_SIZE */ nSize = (nSize <= HT_MIN_SIZE ? HT_MIN_SIZE : (nSize >= HT_MAX_SIZE ? HT_MAX_SIZE : nSize)); + if (nSize < HT_MIN_SIZE) { + nSize = HT_MIN_SIZE; + } else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) { + zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket)); + } #if defined(ZEND_WIN32) if (BitScanReverse(&index, nSize - 1)) {