Skip to content

Commit 28110f8

Browse files
committed
Fix unspecified behaviour in zend_alloc in heap->limit computation
Right-shifting a negative number is unspecified (i.e. implementation-defined) behaviour [1]. If we take a look at the generated assembly [2], we see that the wrong value is computed. Fix it by using Z_UL instead of Z_L. While we're at it, just change every occurrence of this pattern to use Z_UL instead of casting. [1] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1548.pdf §6.5.7.5 [2] https://godbolt.org/z/4Y1qKKjsh Closes GH-12613.
1 parent a8c6c61 commit 28110f8

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

Zend/zend_alloc.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1914,7 +1914,7 @@ static zend_mm_heap *zend_mm_init(void)
19141914
heap->peak = 0;
19151915
#endif
19161916
#if ZEND_MM_LIMIT
1917-
heap->limit = ((size_t)Z_L(-1) >> (size_t)Z_L(1));
1917+
heap->limit = (size_t)Z_L(-1) >> 1;
19181918
heap->overflow = 0;
19191919
#endif
19201920
#if ZEND_MM_CUSTOM
@@ -2859,7 +2859,7 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
28592859
zend_mm_heap *mm_heap = alloc_globals->mm_heap = malloc(sizeof(zend_mm_heap));
28602860
memset(mm_heap, 0, sizeof(zend_mm_heap));
28612861
mm_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_STD;
2862-
mm_heap->limit = ((size_t)Z_L(-1) >> (size_t)Z_L(1));
2862+
mm_heap->limit = (size_t)Z_L(-1) >> 1;
28632863
mm_heap->overflow = 0;
28642864

28652865
if (!tracked) {
@@ -3048,7 +3048,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
30483048
heap->peak = 0;
30493049
#endif
30503050
#if ZEND_MM_LIMIT
3051-
heap->limit = (Z_L(-1) >> Z_L(1));
3051+
heap->limit = (size_t)Z_L(-1) >> 1;
30523052
heap->overflow = 0;
30533053
#endif
30543054
#if ZEND_MM_CUSTOM

0 commit comments

Comments
 (0)