Commit 7ef3bfec06c for php.net

commit 7ef3bfec06c0ec580d074d4f102e4b91860ef497
Author: Georgij Tsarin <nullderef@duck.com>
Date:   Thu Aug 27 17:07:24 2026 +0300

    Fix sparse set allocation size overflow (#23482)

    Fix an integer-overflow risk when calculating the allocation size for IR
    sparse sets.

    Calculate the size separately and assert that multiplying by the element
    count did not overflow before allocating, while preserving the existing
    sparse/dense memory layout. This imports the final upstream IR fix.

    Closes #23482

diff --git a/ext/opcache/jit/ir/ir_private.h b/ext/opcache/jit/ir/ir_private.h
index 3e1051ca337..6d8f31a8b7e 100644
--- a/ext/opcache/jit/ir/ir_private.h
+++ b/ext/opcache/jit/ir/ir_private.h
@@ -495,9 +495,12 @@ typedef struct _ir_sparse_set {

 IR_ALWAYS_INLINE void ir_sparse_set_init(ir_sparse_set *set, uint32_t size)
 {
+	size_t alloc_size = (size_t)size * 2 * sizeof(*set->data);
+
 	set->size = size;
 	set->len = 0;
-	set->data = (uint32_t*)ir_mem_malloc(sizeof(uint32_t) * 2 * size) + size;
+	IR_ASSERT(!size || alloc_size / size == 2 * sizeof(*set->data));
+	set->data = (uint32_t*)ir_mem_malloc(alloc_size) + size;
 #ifdef IR_DEBUG
 	/* initialize sparse part to avoid valgrind warnings */
 	memset(&IR_SPARSE_SET_SPARSE(set, size - 1), 0, size * sizeof(uint32_t));