From: Dmitry Stogov <dmitry@zend.com>
Date: Mon, 1 Jun 2015 07:51:06 +0000 (+0300)
Subject: Fixed integer overflow during HashTable size calculation
X-Git-Tag: php-7.0.0alpha1~56
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1654442ac3e87388829981d551af6093b229e071;p=php

Fixed integer overflow during HashTable size calculation
---

diff --git a/Zend/zend_types.h b/Zend/zend_types.h
index 3834835f86..c1fceab07d 100644
--- a/Zend/zend_types.h
+++ b/Zend/zend_types.h
@@ -229,13 +229,13 @@ struct _zend_array {
 	HT_HASH_EX((ht)->arData, idx)
 
 #define HT_HASH_SIZE(ht) \
-	((-(int32_t)(ht)->nTableMask) * sizeof(uint32_t))
+	(((size_t)(uint32_t)-(int32_t)(ht)->nTableMask) * sizeof(uint32_t))
 #define HT_DATA_SIZE(ht) \
-	((ht)->nTableSize * sizeof(Bucket))
+	((size_t)(ht)->nTableSize * sizeof(Bucket))
 #define HT_SIZE(ht) \
 	(HT_HASH_SIZE(ht) + HT_DATA_SIZE(ht))
 #define HT_USED_SIZE(ht) \
-	(HT_HASH_SIZE(ht) + ((ht)->nNumUsed * sizeof(Bucket)))
+	(HT_HASH_SIZE(ht) + ((size_t)(ht)->nNumUsed * sizeof(Bucket)))
 #define HT_HASH_RESET(ht) \
 	memset(&HT_HASH(ht, (ht)->nTableMask), HT_INVALID_IDX, HT_HASH_SIZE(ht))
 #define HT_HASH_RESET_PACKED(ht) do { \