archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.2' into PHP-8.3

Browse source
This commit is contained in:
David Carlier 2024-11-07 22:52:19 +00:00
commit 3f28644fff
No known key found for this signature in database
GPG key ID: F81D3D3D951B3052
2 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -28,6 +28,8 @@ PHP NEWS
. Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed . Fixed bug GH-16508 (Incorrect line number in inheritance errors of delayed
early bound classes). (ilutov) early bound classes). (ilutov)
. Fixed bug GH-16648 (Use-after-free during array sorting). (ilutov) . Fixed bug GH-16648 (Use-after-free during array sorting). (ilutov)
. Fixed bug GH-15915 (overflow with a high value for precision INI).
(David Carlier / cmb)
- Curl: - Curl:
. Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if . Fixed bug GH-16302 (CurlMultiHandle holds a reference to CurlHandle if

15
Zend/zend_strtod.c
View file

@ -3613,13 +3613,20 @@ rv_alloc(i) int i;
rv_alloc(int i) rv_alloc(int i)
#endif #endif
{ {
int k, *r;
size_t j = sizeof(ULong); int j, k, *r;
size_t rem;
rem = sizeof(Bigint) - sizeof(ULong) - sizeof(int);
j = sizeof(ULong);
if (i > ((INT_MAX >> 2) + rem))
zend_error_noreturn(E_ERROR, "rv_alloc() allocation overflow %d", i);
for(k = 0; for(k = 0;
sizeof(Bigint) - sizeof(ULong) - sizeof(int) + j <= (size_t)i; rem + j <= (size_t)i; j <<= 1)
j <<= 1)
k++; k++;
r = (int*)Balloc(k); r = (int*)Balloc(k);
*r = k; *r = k;
return return