Fixed uint32_t overflow

diff --git a/ext/opcache/zend_accelerator_util_funcs.c b/ext/opcache/zend_accelerator_util_funcs.c
index f8554776a3227acf4f769d70dcc63c2ebf155bec..e04b1ec7db3bbe8a2ffef404d47a07c706a372a1 100644 (file)
--- a/ext/opcache/zend_accelerator_util_funcs.c
+++ b/ext/opcache/zend_accelerator_util_funcs.c
@@ -317,7 +317,7 @@ static zend_ast *zend_ast_clone(zend_ast *ast TSRMLS_DC)
        } else if (zend_ast_is_list(ast)) {
                zend_ast_list *list = zend_ast_get_list(ast);
                zend_ast_list *copy = emalloc(
-                       sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1));
+                       sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children);
                copy->kind = list->kind;
                copy->attr = list->attr;
                copy->children = list->children;
@@ -331,7 +331,7 @@ static zend_ast *zend_ast_clone(zend_ast *ast TSRMLS_DC)
                return (zend_ast *) copy;
        } else {
                uint32_t children = zend_ast_get_num_children(ast);
-               zend_ast *copy = emalloc(sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1));
+               zend_ast *copy = emalloc(sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children);
                copy->kind = ast->kind;
                copy->attr = ast->attr;
                for (i = 0; i < children; i++) {

diff --git a/ext/opcache/zend_persist.c b/ext/opcache/zend_persist.c
index 5e290745bd20249bf21b1dcf4271613d1af55b2e..b49f28f4e300f6600ecf516865406195c3466476 100644 (file)
--- a/ext/opcache/zend_persist.c
+++ b/ext/opcache/zend_persist.c
@@ -154,7 +154,7 @@ static zend_ast *zend_persist_ast(zend_ast *ast TSRMLS_DC)
        } else if (zend_ast_is_list(ast)) {
                zend_ast_list *list = zend_ast_get_list(ast);
                zend_ast_list *copy = zend_accel_memdup(ast,
-                       sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1));
+                       sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children);
                for (i = 0; i < list->children; i++) {
                        if (copy->child[i]) {
                                copy->child[i] = zend_persist_ast(copy->child[i] TSRMLS_CC);
@@ -163,7 +163,7 @@ static zend_ast *zend_persist_ast(zend_ast *ast TSRMLS_DC)
                node = (zend_ast *) copy;
        } else {
                uint32_t children = zend_ast_get_num_children(ast);
-               node = zend_accel_memdup(ast, sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1));
+               node = zend_accel_memdup(ast, sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children);
                for (i = 0; i < children; i++) {
                        if (node->child[i]) {
                                node->child[i] = zend_persist_ast(node->child[i] TSRMLS_CC);

diff --git a/ext/opcache/zend_persist_calc.c b/ext/opcache/zend_persist_calc.c
index 989195119c89cc2bbdd07cb3b4f480fb7fcc02b1..76d1b043b037253f8b8c7101b780a17139305e33 100644 (file)
--- a/ext/opcache/zend_persist_calc.c
+++ b/ext/opcache/zend_persist_calc.c
@@ -91,7 +91,7 @@ static uint zend_persist_ast_calc(zend_ast *ast TSRMLS_DC)
                ADD_SIZE(zend_persist_zval_calc(zend_ast_get_zval(ast) TSRMLS_CC));
        } else if (zend_ast_is_list(ast)) {
                zend_ast_list *list = zend_ast_get_list(ast);
-               ADD_SIZE(sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1));
+               ADD_SIZE(sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children);
                for (i = 0; i < list->children; i++) {
                        if (list->child[i]) {
                                ADD_SIZE(zend_persist_ast_calc(list->child[i] TSRMLS_CC));
@@ -99,7 +99,7 @@ static uint zend_persist_ast_calc(zend_ast *ast TSRMLS_DC)
                }
        } else {
                uint32_t children = zend_ast_get_num_children(ast);
-               ADD_SIZE(sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1));
+               ADD_SIZE(sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children);
                for (i = 0; i < children; i++) {
                        if (ast->child[i]) {
                                ADD_SIZE(zend_persist_ast_calc(ast->child[i] TSRMLS_CC));