From: Nikita Popov <nikita.ppv@gmail.com>
Date: Wed, 19 Jun 2019 12:27:13 +0000 (+0200)
Subject: Fix shift UB in sint4korr()
X-Git-Tag: php-7.4.0alpha2~51^2~11
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f65046b95143a2898d4cf2589219410844a8d20a;p=php

Fix shift UB in sint4korr()
---

diff --git a/ext/mysqlnd/mysqlnd_portability.h b/ext/mysqlnd/mysqlnd_portability.h
index 622e31dcd4..873f49b0cd 100644
--- a/ext/mysqlnd/mysqlnd_portability.h
+++ b/ext/mysqlnd/mysqlnd_portability.h
@@ -191,10 +191,10 @@ typedef union {
                   (((uint32_t) (zend_uchar) (A)[2]) << 16) |\
                   (((uint32_t) (zend_uchar) (A)[1]) << 8) | \
                   ((uint32_t) (zend_uchar) (A)[0])))
-#define sint4korr(A)  (int32_t) (((int32_t) ((zend_uchar) (A)[0])) +\
-                              (((int32_t) ((zend_uchar) (A)[1]) << 8)) +\
-                              (((int32_t) ((zend_uchar) (A)[2]) << 16)) +\
-                              (((int32_t) ((int16_t) (A)[3]) << 24)))
+#define sint4korr(A)  (int32_t) (((uint32_t) ((A)[0])) +\
+                              (((uint32_t) ((A)[1]) << 8)) +\
+                              (((uint32_t) ((A)[2]) << 16)) +\
+                              (((uint32_t) ((A)[3]) << 24)))
 
 #define sint8korr(A)  (int64_t) uint8korr(A)
 #define uint2korr(A)  (uint16_t) (((uint16_t) ((zend_uchar) (A)[0])) +\