From: Nikita Popov <nikita.ppv@gmail.com>
Date: Sun, 18 Feb 2018 16:03:20 +0000 (+0100)
Subject: Fix ZEND_SR range inference
X-Git-Tag: php-7.2.4RC1~63
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=202989edf83fda7ce9dc9fe1ec9a322c63022ba3;p=php

Fix ZEND_SR range inference

Handle out-of-range RHS correctly.
---

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 121d7a8ba3..959b5148dd 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -740,6 +740,23 @@ static int zend_inference_calc_binary_op_range(
 					op2_min = OP2_MIN_RANGE();
 					op1_max = OP1_MAX_RANGE();
 					op2_max = OP2_MAX_RANGE();
+
+					/* Shifts by negative numbers will throw, ignore them */
+					if (op2_min < 0) {
+						op2_min = 0;
+					}
+					if (op2_max < 0) {
+						op2_max = 0;
+					}
+
+					/* Shifts by more than the integer size will be 0 or -1 */
+					if (op2_min >= SIZEOF_ZEND_LONG * 8) {
+						op2_min = SIZEOF_ZEND_LONG * 8 - 1;
+					}
+					if (op2_max >= SIZEOF_ZEND_LONG * 8) {
+						op2_max = SIZEOF_ZEND_LONG * 8 - 1;
+					}
+
 					t1 = op1_min >> op2_min;
 					t2 = op1_min >> op2_max;
 					t3 = op1_max >> op2_min;