Commit e503d47109b for php

commit e503d47109bdd6af8349c503042d49ed7df00d2b
Merge: d47537cf1c0 50207d1f5ad
Author: Ilia Alshanetsky <ilia@ilia.ws>
Date:   Mon Nov 9 10:08:56 2026 -0500

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      ext/opcache: Fix JIT code emitted past the buffer end on 32-bit

diff --cc ext/opcache/jit/ir/ir_aarch64.dasc
index 2269b279284,28a0efb5ca6..2bd57ad7c9d
--- a/ext/opcache/jit/ir/ir_aarch64.dasc
+++ b/ext/opcache/jit/ir/ir_aarch64.dasc
@@@ -9949,8 -7227,7 +9949,8 @@@ void *ir_emit_thunk(ir_code_buffer *cod

  	entry = code_buffer->pos;
  	entry = (void*)IR_ALIGNED_SIZE(((size_t)(entry)), 4);
- 	if (size > (size_t)((char*)code_buffer->end - (char*)entry)) {
+ 	if ((char*)entry > (char*)code_buffer->end || size > (size_t)((char*)code_buffer->end - (char*)entry)) {
 +		*size_ptr = size;
  		dasm_free(&dasm_state);
  		return NULL;
  	}
diff --cc ext/opcache/jit/ir/ir_x86.dasc
index 32320389960,b9e841c67df..9c69cf4d459
--- a/ext/opcache/jit/ir/ir_x86.dasc
+++ b/ext/opcache/jit/ir/ir_x86.dasc
@@@ -26929,8 -12242,8 +26929,8 @@@ next_block:

  	if (ctx->code_buffer) {
  		entry = ctx->code_buffer->pos;
 -		entry = (void*)IR_ALIGNED_SIZE(((size_t)(entry)), 16);
 +		entry = (void*)IR_ALIGNED_SIZE(((size_t)(entry)), required_alignment);
- 		if (size > (size_t)((char*)ctx->code_buffer->end - (char*)entry)) {
+ 		if ((char*)entry > (char*)ctx->code_buffer->end || size > (size_t)((char*)ctx->code_buffer->end - (char*)entry)) {
  			dasm_free(&data.dasm_state);
  			ctx->data = NULL;
  			ctx->status = IR_ERROR_CODE_MEM_OVERFLOW;