Skip to content

Commit f4ba356

Browse files
committed
Merge branch 'PHP-8.3' into PHP-8.4
* PHP-8.3: Correct check for maximum string length in JIT helpers
2 parents 4139381 + a7d2703 commit f4ba356

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

ext/opcache/jit/zend_jit_helpers.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -1637,7 +1637,7 @@ static void ZEND_FASTCALL zend_jit_fast_assign_concat_helper(zval *op1, zval *op
16371637
zend_string *result_str;
16381638
uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
16391639

1640-
if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1640+
if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
16411641
zend_throw_error(NULL, "String size overflow");
16421642
return;
16431643
}
@@ -1673,7 +1673,7 @@ static void ZEND_FASTCALL zend_jit_fast_concat_helper(zval *result, zval *op1, z
16731673
zend_string *result_str;
16741674
uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
16751675

1676-
if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1676+
if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
16771677
zend_throw_error(NULL, "String size overflow");
16781678
return;
16791679
}
@@ -1697,7 +1697,7 @@ static void ZEND_FASTCALL zend_jit_fast_concat_tmp_helper(zval *result, zval *op
16971697
zend_string *result_str;
16981698
uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
16991699

1700-
if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1700+
if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
17011701
zend_throw_error(NULL, "String size overflow");
17021702
return;
17031703
}

0 commit comments

Comments
 (0)