From 3abe15ec45148a1793196ce3e898d58e1e518380 Mon Sep 17 00:00:00 2001 From: Georgij Tsarin Date: Thu, 27 Aug 2026 17:07:24 +0300 Subject: [PATCH] Fix sparse set allocation size overflow --- ext/opcache/jit/ir/ir_private.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ext/opcache/jit/ir/ir_private.h b/ext/opcache/jit/ir/ir_private.h index 3e1051ca3379..6d8f31a8b7ed 100644 --- a/ext/opcache/jit/ir/ir_private.h +++ b/ext/opcache/jit/ir/ir_private.h @@ -495,9 +495,12 @@ typedef struct _ir_sparse_set { IR_ALWAYS_INLINE void ir_sparse_set_init(ir_sparse_set *set, uint32_t size) { + size_t alloc_size = (size_t)size * 2 * sizeof(*set->data); + set->size = size; set->len = 0; - set->data = (uint32_t*)ir_mem_malloc(sizeof(uint32_t) * 2 * size) + size; + IR_ASSERT(!size || alloc_size / size == 2 * sizeof(*set->data)); + set->data = (uint32_t*)ir_mem_malloc(alloc_size) + size; #ifdef IR_DEBUG /* initialize sparse part to avoid valgrind warnings */ memset(&IR_SPARSE_SET_SPARSE(set, size - 1), 0, size * sizeof(uint32_t));