[php-src] PR #23702: Fix GH-22505: Range check incorrectly rejects arrays of maximum size
| From: | prateekbhujel | Date: | Wed, 16 Sep 2026 09:18:00 +0000 |
| Subject: | [php-src] PR #23702: Fix GH-22505: Range check incorrectly rejects arrays of maximum size | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38500@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23702
Author: prateekbhujel
Closes #22505.
In ext/standard/array.c, RANGE_CHECK_LONG_INIT_ARRAY calculates __calc_size as ((start - end) /
step) and size as __calc_size plus one. It checked whether __calc_size was greater than or equal to
HT_MAX_SIZE minus one. Because of this, when __calc_size was exactly HT_MAX_SIZE minus one, size was
HT_MAX_SIZE (1073741824 elements), which is the maximum supported array capacity in Zend hashtables.
The check prematurely triggered a ValueError before memory allocation.
Similarly, in RANGE_CHECK_DOUBLE_INIT_ARRAY, __calc_size includes plus one and checked greater than
or equal to HT_MAX_SIZE instead of strictly greater than.
This fix:
1. Adjusts RANGE_CHECK_LONG_INIT_ARRAY to check __calc_size >= HT_MAX_SIZE so arrays with exactly
HT_MAX_SIZE elements are accepted.
2. Adjusts RANGE_CHECK_DOUBLE_INIT_ARRAY to check __calc_size > (double)HT_MAX_SIZE.
3. Adds a regression test verifying that range(0, 1073741824) throws ValueError while range(0,
1073741823) passes range validation.