[php-src] PR #23702: Fix GH-22505: Range check incorrectly rejects arrays of maximum size

From: Date: Wed, 16 Sep 2026 09:18:00 +0000
Subject: [php-src] PR #23702: Fix GH-22505: Range check incorrectly rejects arrays of maximum size
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38500@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23702 Author: prateekbhujel Closes #22505. In ext/standard/array.c, RANGE_CHECK_LONG_INIT_ARRAY calculates __calc_size as ((start - end) / step) and size as __calc_size plus one. It checked whether __calc_size was greater than or equal to HT_MAX_SIZE minus one. Because of this, when __calc_size was exactly HT_MAX_SIZE minus one, size was HT_MAX_SIZE (1073741824 elements), which is the maximum supported array capacity in Zend hashtables. The check prematurely triggered a ValueError before memory allocation. Similarly, in RANGE_CHECK_DOUBLE_INIT_ARRAY, __calc_size includes plus one and checked greater than or equal to HT_MAX_SIZE instead of strictly greater than. This fix: 1. Adjusts RANGE_CHECK_LONG_INIT_ARRAY to check __calc_size >= HT_MAX_SIZE so arrays with exactly HT_MAX_SIZE elements are accepted. 2. Adjusts RANGE_CHECK_DOUBLE_INIT_ARRAY to check __calc_size > (double)HT_MAX_SIZE. 3. Adds a regression test verifying that range(0, 1073741824) throws ValueError while range(0, 1073741823) passes range validation.

« previous php.git-pulls (#38500) next »