[php-src] PR #24994: Fix zend_inference: fix unsound shift_left_overflows range when shift…
| From: | mkrishna793 | Date: | Wed, 28 Oct 2026 05:16:48 +0000 |
| Subject: | [php-src] PR #24994: Fix zend_inference: fix unsound shift_left_overflows range when shift… | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-40009@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24994
Author: mkrishna793
### Summary of Changes
In
Zend/Optimizer/zend_inference.c, shift_left_overflows(n, s) previously
checked safe_shift_left(n, s) > n for negative inputs. When (n <<
s) wrapped around to a value <= n (such as ZEND_LONG_MIN or
negative wrapped values), the check falsely returned false (no overflow). Positive
shifts also missed overflow when wrapping around (e.g. 7041795614029497201 << 6).
This PR replaces the heuristic with a round-trip arithmetic shift check ((shifted >> s)
!= n) that soundly detects overflow across all 64-bit and 32-bit inputs.
Includes the regression test provided by @arnaud-lb in
Zend/tests/shift_left_overflow_range.phpt.