From 2bc0a6e97f7e9f643d8d181ac0ffd6b40757aae7 Mon Sep 17 00:00:00 2001 From: Nikita Popov Date: Fri, 20 Dec 2019 12:11:07 +0100 Subject: [PATCH] Fix string offset signed int UB in jit as well --- ext/opcache/jit/zend_jit_helpers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ext/opcache/jit/zend_jit_helpers.c b/ext/opcache/jit/zend_jit_helpers.c index 0efd07c3dc..e2ba36c9ee 100644 --- a/ext/opcache/jit/zend_jit_helpers.c +++ b/ext/opcache/jit/zend_jit_helpers.c @@ -610,7 +610,7 @@ try_string_offset: offset = Z_LVAL_P(dim); } - if (UNEXPECTED(Z_STRLEN_P(container) < (size_t)((offset < 0) ? -offset : (offset + 1)))) { + if (UNEXPECTED(Z_STRLEN_P(container) < ((offset < 0) ? -(size_t)offset : ((size_t)offset + 1)))) { zend_error(E_WARNING, "Uninitialized string offset: " ZEND_LONG_FMT, offset); ZVAL_EMPTY_STRING(result); } else { @@ -658,7 +658,7 @@ try_string_offset: offset = Z_LVAL_P(dim); } - if (UNEXPECTED(Z_STRLEN_P(container) < (size_t)((offset < 0) ? -offset : (offset + 1)))) { + if (UNEXPECTED(Z_STRLEN_P(container) < ((offset < 0) ? -(size_t)offset : ((size_t)offset + 1)))) { ZVAL_NULL(result); } else { zend_uchar c; -- 2.50.1