Review

arnaud-lb · arnaud-lb · commit 1f1cede531bc · 2026-07-14T17:49:22.000+02:00
diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
@@ -2152,7 +2152,7 @@ zend_op_array *zend_accel_compile_pfa(zend_ast *ast,
 			/* Reference the copy in op_array->dynamic_func_defs so that it's
 			 * destroyed when op_array is destroyed. */
 			ZEND_ASSERT(!op_array->dynamic_func_defs && !op_array->num_dynamic_func_defs);
-			op_array->dynamic_func_defs = emalloc(sizeof(*op_array->dynamic_func_defs));
+			op_array->dynamic_func_defs = safe_emalloc(1, sizeof(*op_array->dynamic_func_defs), 0);
 			op_array->dynamic_func_defs[0] = copy;
 			op_array->num_dynamic_func_defs = 1;
 		}

Original file line number	Diff line number	Diff line change
`@@ -2152,7 +2152,7 @@ zend_op_array zend_accel_compile_pfa(zend_ast ast,`
`2152`	`2152`	`/* Reference the copy in op_array->dynamic_func_defs so that it's`
`2153`	`2153`	`* destroyed when op_array is destroyed. */`
`2154`	`2154`	`ZEND_ASSERT(!op_array->dynamic_func_defs && !op_array->num_dynamic_func_defs);`
`2155`		`- op_array->dynamic_func_defs = emalloc(sizeof(*op_array->dynamic_func_defs));`
	`2155`	`+ op_array->dynamic_func_defs = safe_emalloc(1, sizeof(*op_array->dynamic_func_defs), 0);`
`2156`	`2156`	`op_array->dynamic_func_defs[0] = copy;`
`2157`	`2157`	`op_array->num_dynamic_func_defs = 1;`
`2158`	`2158`	`}`