[php-src] PR #23257: Keep EG(errors) buffer consistent on erealloc failure
| From: | edorian | Date: | Thu, 13 Aug 2026 16:40:46 +0000 |
| Subject: | [php-src] PR #23257: Keep EG(errors) buffer consistent on erealloc failure | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37831@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23257
Author: edorian
Update the error count only after the buffer has been resized and the new entry initialized. This
prevents fatal error handling from reading past the buffer if reallocating it triggers an OOM
bailout.
This zend_bailout path is also present in 8.5, the patch there would look like this:
```diff
- EG(num_errors)++;
- EG(errors) = erealloc(EG(errors), sizeof(zend_error_info*) * EG(num_errors));
- EG(errors)[EG(num_errors)-1] = info;
+ uint32_t new_num_errors = EG(num_errors) + 1;
+ EG(errors) = erealloc(EG(errors), sizeof(zend_error_info*) * new_num_errors);
+ EG(errors)[EG(num_errors)] = info;
+ EG(num_errors) = new_num_errors;
```
---
If this fix is accepted, should I target 8.5 with a different PR, or what's the best workflow
for changes that don't cleanly upmerge? I'm inexperienced in this regard.