Skip to content

Commit 5ca72ec

Browse files
authored
Remove broken check in var_unserializer (#13852)
`end = *p+maxlen`, and pointer overflow is UB, so that means that a check of the form `end < *p` will always be false because it can only be true on pointer overflow. In particular, the compiler simplifies this to `maxlen < 0` which is always false because maxlen is unsigned.
1 parent 15259a0 commit 5ca72ec

File tree

1 file changed

+0
-5
lines changed

1 file changed

+0
-5
lines changed

ext/standard/var_unserializer.re

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -326,11 +326,6 @@ static zend_string *unserialize_str(const unsigned char **p, size_t len, size_t
326326
zend_string *str = zend_string_safe_alloc(1, len, 0, 0);
327327
unsigned char *end = *(unsigned char **)p+maxlen;
328328

329-
if (end < *p) {
330-
zend_string_efree(str);
331-
return NULL;
332-
}
333-
334329
for (i = 0; i < len; i++) {
335330
if (*p >= end) {
336331
zend_string_efree(str);

0 commit comments

Comments
 (0)