Skip to content

Commit a7d2703

Browse files
committed
Correct check for maximum string length in JIT helpers
This is a bit of a theoretical issue, but the maximum string length is actually ZSTR_MAX_LEN instead of SIZE_MAX. The resulting check is a bit slower but should still be relatively cheap. Closes GH-18049.
1 parent 1158a1e commit a7d2703

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

ext/opcache/jit/zend_jit_helpers.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1636,7 +1636,7 @@ static void ZEND_FASTCALL zend_jit_fast_assign_concat_helper(zval *op1, zval *op
16361636
zend_string *result_str;
16371637
uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
16381638

1639-
if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1639+
if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
16401640
zend_throw_error(NULL, "String size overflow");
16411641
return;
16421642
}
@@ -1672,7 +1672,7 @@ static void ZEND_FASTCALL zend_jit_fast_concat_helper(zval *result, zval *op1, z
16721672
zend_string *result_str;
16731673
uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
16741674

1675-
if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1675+
if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
16761676
zend_throw_error(NULL, "String size overflow");
16771677
return;
16781678
}
@@ -1696,7 +1696,7 @@ static void ZEND_FASTCALL zend_jit_fast_concat_tmp_helper(zval *result, zval *op
16961696
zend_string *result_str;
16971697
uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
16981698

1699-
if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1699+
if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
17001700
zend_throw_error(NULL, "String size overflow");
17011701
return;
17021702
}

0 commit comments

Comments
 (0)