Skip to content

Commit f3c45c1

Browse files
committed
Revert "Fix #73122: Integer Overflow when concatenating strings"
This reverts commit f1ce8d5, which has been accidentially pushed.
1 parent f1ce8d5 commit f3c45c1

File tree

2 files changed

+1
-4
lines changed

2 files changed

+1
-4
lines changed

Zend/zend_operators.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1882,7 +1882,7 @@ ZEND_API int ZEND_FASTCALL concat_function(zval *result, zval *op1, zval *op2) /
18821882
size_t result_len = op1_len + op2_len;
18831883
zend_string *result_str;
18841884

1885-
if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len || op2_len > ZSTR_MAX_LEN)) {
1885+
if (UNEXPECTED(op1_len > ZSTR_MAX_LEN - op2_len)) {
18861886
zend_throw_error(NULL, "String size overflow");
18871887
zval_ptr_dtor_str(&op1_copy);
18881888
zval_ptr_dtor_str(&op2_copy);

Zend/zend_vm_def.h

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -416,9 +416,6 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
416416
!ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
417417
size_t len = ZSTR_LEN(op1_str);
418418

419-
if (UNEXPECTED(ZSTR_LEN(op2_str) > ZSTR_MAX_LEN - len || len > ZSTR_MAX_LEN)) {
420-
zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
421-
}
422419
str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
423420
memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
424421
ZVAL_NEW_STR(EX_VAR(opline->result.var), str);

0 commit comments

Comments
 (0)