Commit dab13a022a5 for php.net
commit dab13a022a54f8bc03302f93ccb6484907ec1245
Author: Volker Dusch <247397+edorian@users.noreply.github.com>
Date: Wed Sep 2 18:13:09 2026 +0200
Keep EG(errors) buffer consistent on erealloc failure (#23257)
Update the error count only after the buffer has been resized and the new
entry initialized. This prevents fatal error handling from reading past the
buffer if reallocating it triggers an OOM bailout.
Prefer safe_erealloc to avoid overflows
---------
Co-authored-by: Tim Düsterhus <timwolla@googlemail.com>
diff --git a/Zend/zend.c b/Zend/zend.c
index e58566541dd..aa621c4daa8 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -1486,9 +1486,10 @@ ZEND_API ZEND_COLD void zend_error_zstr_at(
/* This is very inefficient for a large number of errors.
* Use pow2 realloc if it becomes a problem. */
- EG(num_errors)++;
- EG(errors) = erealloc(EG(errors), sizeof(zend_error_info*) * EG(num_errors));
- EG(errors)[EG(num_errors)-1] = info;
+ uint32_t new_num_errors = EG(num_errors) + 1;
+ EG(errors) = safe_erealloc(EG(errors), new_num_errors, sizeof(zend_error_info*), 0);
+ EG(errors)[EG(num_errors)] = info;
+ EG(num_errors) = new_num_errors;
/* Do not process non-fatal recorded error */
if (!(type & E_FATAL_ERRORS) || (type & E_DONT_BAIL)) {