[php-src] PR #23482: Fix sparse set allocation size overflow
| From: | crystarm | Date: | Thu, 27 Aug 2026 14:11:09 +0000 |
| Subject: | [php-src] PR #23482: Fix sparse set allocation size overflow | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38170@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23482
Author: crystarm
Fixes an integer-overflow risk when calculating the allocation size for IR sparse sets.
Uses
ir_mem_calloc(size, 2 * sizeof(*set->data)) so the allocator performs the
checked multiplication, while preserving the existing sparse/dense memory layout.
The issue was detected by static analysis: [BAD_ALLOC_ARITHMETIC
ir_private.h:[500:14].log](https://github.com/user-attachments/files/31518404/BAD_ALLOC_ARITHMETIC.ir_private.h.500.14.log)