From 45254b678cb8370e727c68377e759214d9c9ad7e Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Fri, 30 Oct 2026 17:29:22 +0000 Subject: [PATCH 1/3] tree: use correct argument ordering for safe_emalloc() It is (nmemb, size, offset) not (size, nmemb, offset). Use sizeof(char) instead of 1 For quoting allocations use (lenght*2, sizeof(char), offset) rather than various different combinations. --- Zend/Optimizer/compact_vars.c | 2 +- Zend/zend_compile.c | 18 +++++++++--------- Zend/zend_stream.c | 2 +- Zend/zend_string.h | 2 +- ext/hash/hash.c | 2 +- ext/intl/converter/converter.cpp | 2 +- ext/intl/msgformat/msgformat_data.cpp | 2 +- ext/intl/uchar/uchar.cpp | 2 +- ext/odbc/php_odbc.c | 6 +++--- ext/pdo/pdo_stmt.c | 2 +- ext/pdo_pgsql/pgsql_driver.c | 2 +- ext/pdo_sqlite/sqlite_driver.c | 2 +- ext/pgsql/pgsql.c | 10 +++++----- ext/phar/tar.c | 2 +- ext/phar/util.c | 2 +- ext/snmp/snmp.c | 2 +- ext/soap/php_encoding.c | 14 +++++++------- ext/soap/soap.c | 2 +- ext/standard/basic_functions.c | 4 ++-- ext/standard/proc_open.c | 2 +- ext/standard/scanf.c | 6 +++--- ext/standard/user_filters.c | 2 +- ext/standard/versioning.c | 2 +- main/streams/filter.c | 2 +- 24 files changed, 47 insertions(+), 47 deletions(-) diff --git a/Zend/Optimizer/compact_vars.c b/Zend/Optimizer/compact_vars.c index f6c39e9fe166..c1b48577811b 100644 --- a/Zend/Optimizer/compact_vars.c +++ b/Zend/Optimizer/compact_vars.c @@ -96,7 +96,7 @@ void zend_optimizer_compact_vars(zend_op_array *op_array) { /* Update CV name table */ if (num_cvs != op_array->last_var) { if (num_cvs) { - zend_string **names = safe_emalloc(sizeof(zend_string *), num_cvs, 0); + zend_string **names = safe_emalloc(num_cvs, sizeof(zend_string *), 0); for (i = 0; i < op_array->last_var; i++) { if (vars_map[i] != (uint32_t) -1) { names[vars_map[i]] = op_array->vars[i]; diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index f71a245526a3..20cfc4dead16 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -5208,7 +5208,7 @@ static zend_result zend_compile_func_sprintf(znode *result, zend_ast_list *args) znode *elements = NULL; if (placeholder_count > 0) { - elements = safe_emalloc(sizeof(*elements), placeholder_count, 0); + elements = safe_emalloc(placeholder_count, sizeof(*elements), 0); } /* Compile the value expressions first for error handling that is consistent @@ -6816,7 +6816,7 @@ static void zend_compile_if(zend_ast *ast) /* {{{ */ uint32_t *jmp_opnums = NULL; if (list->children > 1) { - jmp_opnums = safe_emalloc(sizeof(uint32_t), list->children - 1, 0); + jmp_opnums = safe_emalloc(list->children - 1, sizeof(uint32_t), 0); } for (i = 0; i < list->children; ++i) { @@ -6956,7 +6956,7 @@ static void zend_compile_switch(zend_ast *ast) /* {{{ */ opnum_switch = opline - CG(active_op_array)->opcodes; } - jmpnz_opnums = safe_emalloc(sizeof(uint32_t), cases->children, 0); + jmpnz_opnums = safe_emalloc(cases->children, sizeof(uint32_t), 0); for (i = 0; i < cases->children; ++i) { zend_ast *case_ast = cases->child[i]; zend_ast *cond_ast = case_ast->child[0]; @@ -7294,7 +7294,7 @@ static void zend_compile_match(znode *result, zend_ast *ast) } opnum_match = opline - CG(active_op_array)->opcodes; } else { - jmpnz_opnums = safe_emalloc(sizeof(uint32_t), num_conds, 0); + jmpnz_opnums = safe_emalloc(num_conds, sizeof(uint32_t), 0); uint32_t cond_count = 0; for (uint32_t i = 0; i < arms->children; ++i) { zend_ast *arm_ast = arms->child[i]; @@ -7331,7 +7331,7 @@ static void zend_compile_match(znode *result, zend_ast *ast) bool is_first_case = true; uint32_t cond_count = 0; - uint32_t *jmp_end_opnums = safe_emalloc(sizeof(uint32_t), arms->children, 0); + uint32_t *jmp_end_opnums = safe_emalloc(arms->children, sizeof(uint32_t), 0); // The generated default arm is emitted first to avoid live range issues where the tmpvar // for the arm result is freed even though it has not been initialized yet. @@ -7441,7 +7441,7 @@ static void zend_compile_try(const zend_ast *ast) /* {{{ */ uint32_t i, j; zend_op *opline; uint32_t try_catch_offset; - uint32_t *jmp_opnums = safe_emalloc(sizeof(uint32_t), catches->children, 0); + uint32_t *jmp_opnums = safe_emalloc(catches->children, sizeof(uint32_t), 0); uint32_t orig_fast_call_var = CG(context).fast_call_var; uint32_t orig_try_catch_offset = CG(context).try_catch_offset; @@ -7493,7 +7493,7 @@ static void zend_compile_try(const zend_ast *ast) /* {{{ */ zend_string *var_name = var_ast ? zval_make_interned_string(zend_ast_get_zval(var_ast)) : NULL; bool is_last_catch = (i + 1 == catches->children); - uint32_t *jmp_multicatch = safe_emalloc(sizeof(uint32_t), classes->children - 1, 0); + uint32_t *jmp_multicatch = safe_emalloc(classes->children - 1, sizeof(uint32_t), 0); uint32_t opnum_catch = (uint32_t)-1; CG(zend_lineno) = catch_ast->lineno; @@ -8440,7 +8440,7 @@ static void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast, uint32 if (return_type_ast || fallback_return_type) { /* Use op_array->arg_info[-1] for return type */ - arg_infos = safe_emalloc(sizeof(zend_arg_info), list->children + 1, 0); + arg_infos = safe_emalloc(list->children + 1, sizeof(zend_arg_info), 0); arg_infos->name = NULL; if (return_type_ast) { arg_infos->type = zend_compile_typename(return_type_ast); @@ -8463,7 +8463,7 @@ static void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast, uint32 if (list->children == 0) { return; } - arg_infos = safe_emalloc(sizeof(zend_arg_info), list->children, 0); + arg_infos = safe_emalloc(list->children, sizeof(zend_arg_info), 0); } /* Find last required parameter number for deprecation message. */ diff --git a/Zend/zend_stream.c b/Zend/zend_stream.c index 0627ae145939..cbbf7e63454b 100644 --- a/Zend/zend_stream.c +++ b/Zend/zend_stream.c @@ -160,7 +160,7 @@ ZEND_API zend_result zend_stream_fixup(zend_file_handle *file_handle, char **buf if (file_size) { ssize_t read; size_t size = 0; - *buf = safe_emalloc(1, file_size, ZEND_MMAP_AHEAD); + *buf = safe_emalloc(file_size, sizeof(char), ZEND_MMAP_AHEAD); while ((read = zend_stream_read(file_handle, *buf + size, file_size - size)) > 0) { size += read; } diff --git a/Zend/zend_string.h b/Zend/zend_string.h index d5674f3ff1c4..d2b2d1f3d855 100644 --- a/Zend/zend_string.h +++ b/Zend/zend_string.h @@ -420,7 +420,7 @@ static zend_always_inline zend_string *zend_string_safe_realloc(zend_string *s, } static zend_always_inline char *zend_cstr_append_char(const char *str, size_t len, char c) { - char *res = (char *)safe_emalloc(len, 1, 2); + char *res = (char *)safe_emalloc(len, sizeof(char), 2); if (len > 0) { memcpy(res, str, len); } diff --git a/ext/hash/hash.c b/ext/hash/hash.c index a950d824700f..a289ab5e8f5f 100644 --- a/ext/hash/hash.c +++ b/ext/hash/hash.c @@ -1039,7 +1039,7 @@ PHP_FUNCTION(hash_pbkdf2) result = safe_emalloc(loops, ops->digest_size, 0); - computed_salt = safe_emalloc(salt_len, 1, 4); + computed_salt = safe_emalloc(salt_len, sizeof(unsigned char), 4); memcpy(computed_salt, (unsigned char *) salt, salt_len); for (i = 1; i <= loops; i++) { diff --git a/ext/intl/converter/converter.cpp b/ext/intl/converter/converter.cpp index 55c35399fe00..ded841b981f7 100644 --- a/ext/intl/converter/converter.cpp +++ b/ext/intl/converter/converter.cpp @@ -609,7 +609,7 @@ static zend_string* php_converter_do_convert(UConverter *dest_cnv, THROW_UFAILURE(objval, error); return nullptr; } - temp = reinterpret_cast(safe_femalloc(sizeof(UChar), temp_len, sizeof(UChar), /* fallible */ true)); + temp = reinterpret_cast(safe_femalloc(temp_len, sizeof(UChar), sizeof(UChar), /* fallible */ true)); if (!temp) { return NULL; } diff --git a/ext/intl/msgformat/msgformat_data.cpp b/ext/intl/msgformat/msgformat_data.cpp index 0a059a9ea48f..c2db3ec426ed 100644 --- a/ext/intl/msgformat/msgformat_data.cpp +++ b/ext/intl/msgformat/msgformat_data.cpp @@ -68,7 +68,7 @@ void msgformat_data_free(msgformat_data* mf_data) int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec) { if(*spattern && *spattern_len && u_strchr(*spattern, (UChar)'\'')) { - UChar *npattern = safe_emalloc(sizeof(UChar)*2, *spattern_len, sizeof(UChar)); + UChar *npattern = safe_emalloc(*spattern_len, sizeof(UChar)*2, sizeof(UChar)); uint32_t npattern_len; npattern_len = umsg_autoQuoteApostrophe(*spattern, *spattern_len, npattern, 2*(*spattern_len)+1, ec); efree(*spattern); diff --git a/ext/intl/uchar/uchar.cpp b/ext/intl/uchar/uchar.cpp index 3b3edfca49a9..9479287b5e03 100644 --- a/ext/intl/uchar/uchar.cpp +++ b/ext/intl/uchar/uchar.cpp @@ -544,7 +544,7 @@ IC_METHOD(getFC_NFKC_Closure) { if (closure_len == 0) { RETURN_EMPTY_STRING(); } - closure = reinterpret_cast(safe_emalloc(sizeof(UChar), closure_len + 1, 0)); + closure = reinterpret_cast(safe_emalloc(closure_len + 1, sizeof(UChar), 0)); error = U_ZERO_ERROR; closure_len = u_getFC_NFKC_Closure(cp, closure, closure_len, &error); if (U_FAILURE(error)) { diff --git a/ext/odbc/php_odbc.c b/ext/odbc/php_odbc.c index e10d60d64cb3..044e90df54cc 100644 --- a/ext/odbc/php_odbc.c +++ b/ext/odbc/php_odbc.c @@ -684,7 +684,7 @@ void odbc_bindcols(odbc_result *result) SQLLEN displaysize; SQLUSMALLINT colfieldid; - result->values = (odbc_result_value *) safe_emalloc(sizeof(odbc_result_value), result->numcols, 0); + result->values = (odbc_result_value *) safe_emalloc(result->numcols, sizeof(odbc_result_value), 0); result->longreadlen = ODBCG(defaultlrl); result->binmode = ODBCG(defaultbinmode); @@ -954,7 +954,7 @@ PHP_FUNCTION(odbc_prepare) result->fetched = 0; odbc_insert_new_result(conn, return_value); - result->param_info = (odbc_param_info *) safe_emalloc(sizeof(odbc_param_info), result->numparams, 0); + result->param_info = (odbc_param_info *) safe_emalloc(result->numparams, sizeof(odbc_param_info), 0); for (i=0;inumparams;i++) { rc = SQLDescribeParam(result->stmt, (SQLUSMALLINT)(i+1), &result->param_info[i].sqltype, &result->param_info[i].precision, &result->param_info[i].scale, &result->param_info[i].nullable); @@ -1017,7 +1017,7 @@ PHP_FUNCTION(odbc_execute) RETURN_FALSE; } - params = (odbc_params_t *)safe_emalloc(sizeof(odbc_params_t), result->numparams, 0); + params = (odbc_params_t *)safe_emalloc(result->numparams, sizeof(odbc_params_t), 0); for(i = 0; i < result->numparams; i++) { params[i].fp = -1; params[i].zstr = NULL; diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c index 7f39a2d57029..ce4253c82c91 100644 --- a/ext/pdo/pdo_stmt.c +++ b/ext/pdo/pdo_stmt.c @@ -825,7 +825,7 @@ static bool do_fetch(pdo_stmt_t *stmt, zval *return_value, enum pdo_fetch_type h } /* There will be at most stmt->column_count parameters. * However, if we fetch a group key we will have over allocated. */ - fetch_function_params = safe_emalloc(sizeof(zval), stmt->column_count, 0); + fetch_function_params = safe_emalloc(stmt->column_count, sizeof(zval), 0); break; default: ZEND_UNREACHABLE(); } diff --git a/ext/pdo_pgsql/pgsql_driver.c b/ext/pdo_pgsql/pgsql_driver.c index 548a47c3ee83..bf483baf0309 100644 --- a/ext/pdo_pgsql/pgsql_driver.c +++ b/ext/pdo_pgsql/pgsql_driver.c @@ -451,7 +451,7 @@ static zend_string* pgsql_handle_quoter(pdo_dbh_t *dbh, const zend_string *unquo PQfreemem(escaped); break; default: - quoted = safe_emalloc(2, ZSTR_LEN(unquoted), 3); + quoted = safe_emalloc(ZSTR_LEN(unquoted) * 2, sizeof(char), 3); quoted[0] = '\''; quotedlen = PQescapeStringConn(H->server, quoted + 1, ZSTR_VAL(unquoted), ZSTR_LEN(unquoted), &err); if (err) { diff --git a/ext/pdo_sqlite/sqlite_driver.c b/ext/pdo_sqlite/sqlite_driver.c index 39efa02dd583..4a14aa777d1e 100644 --- a/ext/pdo_sqlite/sqlite_driver.c +++ b/ext/pdo_sqlite/sqlite_driver.c @@ -237,7 +237,7 @@ static zend_string* sqlite_handle_quoter(pdo_dbh_t *dbh, const zend_string *unqu return NULL; } - quoted = safe_emalloc(2, ZSTR_LEN(unquoted), 3); + quoted = safe_emalloc(ZSTR_LEN(unquoted) * 2, sizeof(char), 3); /* TODO use %Q format? */ sqlite3_snprintf(2*ZSTR_LEN(unquoted) + 3, quoted, "'%q'", ZSTR_VAL(unquoted)); zend_string *quoted_str = zend_string_init(quoted, strlen(quoted), 0); diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c index 90bb203e4a6d..3fc2b19ab40a 100644 --- a/ext/pgsql/pgsql.c +++ b/ext/pgsql/pgsql.c @@ -1217,7 +1217,7 @@ static char **php_pgsql_make_arguments(const HashTable *param_arr, int *num_para { /* This conversion is safe because of the limit of number of elements in a table. */ *num_params = (int) zend_hash_num_elements(param_arr); - char **params = safe_emalloc(sizeof(char *), *num_params, 0); + char **params = safe_emalloc(*num_params, sizeof(char *), 0); uint32_t i = 0; ZEND_HASH_FOREACH_VAL(param_arr, zval *tmp) { @@ -4570,7 +4570,7 @@ PHP_PGSQL_API zend_result php_pgsql_meta_data(PGconn *pg_link, const zend_string "WHERE a.attnum > 0 AND c.relname = '"); } len = strlen(tmp_name2); - escaped = (char *)safe_emalloc(len, 2, 1); + escaped = (char *)safe_emalloc(len * 2, sizeof(char), 1); new_len = PQescapeStringConn(pg_link, escaped, tmp_name2, len, &err); if (err) { php_error_docref(NULL, E_WARNING, "Escaping table name '%s' failed", ZSTR_VAL(table_name)); @@ -4586,7 +4586,7 @@ PHP_PGSQL_API zend_result php_pgsql_meta_data(PGconn *pg_link, const zend_string smart_str_appends(&querystr, "' AND n.nspname = '"); len = strlen(tmp_name); - escaped = (char *)safe_emalloc(len, 2, 1); + escaped = (char *)safe_emalloc(len * 2, sizeof(char), 1); new_len = PQescapeStringConn(pg_link, escaped, tmp_name, len, &err); if (err) { php_error_docref(NULL, E_WARNING, "Escaping table namespace '%s' failed", ZSTR_VAL(table_name)); @@ -5640,7 +5640,7 @@ PHP_PGSQL_API zend_result php_pgsql_insert(PGconn *pg_link, const zend_string *t case IS_STRING: if (opt & PGSQL_DML_ESCAPE) { int error; - char *tmp = safe_emalloc(Z_STRLEN_P(val), 2, 1); + char *tmp = safe_emalloc(Z_STRLEN_P(val) * 2, sizeof(char), 1); size_t new_len = PQescapeStringConn(pg_link, tmp, Z_STRVAL_P(val), Z_STRLEN_P(val), &error); if (error) { php_error_docref(NULL, E_NOTICE, "Failed to escape field '%s' value", ZSTR_VAL(fld)); @@ -5824,7 +5824,7 @@ static inline int build_assignment_string(PGconn *pg_link, smart_str *querystr, case IS_STRING: if (opt & PGSQL_DML_ESCAPE) { int error; - char *tmp = (char *)safe_emalloc(Z_STRLEN_P(val), 2, 1); + char *tmp = (char *)safe_emalloc(Z_STRLEN_P(val) * 2, sizeof(char), 1); size_t new_len = PQescapeStringConn(pg_link, tmp, Z_STRVAL_P(val), Z_STRLEN_P(val), &error); if (error) { php_error_docref(NULL, E_NOTICE, "Failed to escape field '%s' value", ZSTR_VAL(fld)); diff --git a/ext/phar/tar.c b/ext/phar/tar.c index c48061740e26..3c9e155541eb 100644 --- a/ext/phar/tar.c +++ b/ext/phar/tar.c @@ -212,7 +212,7 @@ static zend_result phar_tar_process_metadata(phar_entry_info *entry, php_stream size_t save = php_stream_tell(fp), read; phar_entry_info *mentry; - metadata = (char *) safe_emalloc(1, entry->uncompressed_filesize, 1); + metadata = (char *) safe_emalloc(entry->uncompressed_filesize, sizeof(char), 1); read = php_stream_read(fp, metadata, entry->uncompressed_filesize); if (read != entry->uncompressed_filesize) { diff --git a/ext/phar/util.c b/ext/phar/util.c index 539b927657b3..2d636e9b84f5 100644 --- a/ext/phar/util.c +++ b/ext/phar/util.c @@ -1352,7 +1352,7 @@ static size_t phar_hex_str(const char *digest, size_t digest_len, char **signatu size_t pos = 0; size_t len = 0; - *signature = (char*)safe_pemalloc(digest_len, 2, 1, PHAR_G(persist)); + *signature = (char*)safe_pemalloc(digest_len * 2, sizeof(char), 1, PHAR_G(persist)); for (; len < digest_len; ++len) { (*signature)[pos++] = hexChars[((const unsigned char *)digest)[len] >> 4]; diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c index 0c0607392366..49c7c6859d06 100644 --- a/ext/snmp/snmp.c +++ b/ext/snmp/snmp.c @@ -707,7 +707,7 @@ static bool php_snmp_parse_oid( zend_argument_value_error(oid_arg_num, "must not be empty when passed as an array"); return false; } - objid_query->vars = (snmpobjarg *)safe_emalloc(sizeof(snmpobjarg), zend_hash_num_elements(oid_ht), 0); + objid_query->vars = (snmpobjarg *)safe_emalloc(zend_hash_num_elements(oid_ht), sizeof(snmpobjarg), 0); memset(objid_query->vars, 0, sizeof(snmpobjarg) * zend_hash_num_elements(oid_ht)); objid_query->array_output = (st & SNMP_CMD_SET) == 0; ZEND_HASH_FOREACH_VAL(oid_ht, tmp_oid) { diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c index bc70c06fac3b..be37c4e6032d 100644 --- a/ext/soap/php_encoding.c +++ b/ext/soap/php_encoding.c @@ -984,7 +984,7 @@ static xmlNodePtr to_xml_hexbin(encodeTypePtr type, zval *data, int style, xmlNo ZVAL_STR(&tmp, get_serialization_string_from_zval(data)); data = &tmp; } - str = (unsigned char *) safe_emalloc(Z_STRLEN_P(data), 2, 1); + str = (unsigned char *) safe_emalloc(Z_STRLEN_P(data) * 2, sizeof(unsigned char), 1); for (i = j = 0; i < Z_STRLEN_P(data); i++) { str[j++] = hexconvtab[((unsigned char)Z_STRVAL_P(data)[i]) >> 4]; @@ -2076,7 +2076,7 @@ static int* get_position_12(int dimension, const char* str) int *pos; int i = -1, flag = 0; - pos = safe_emalloc(sizeof(int), dimension, 0); + pos = safe_emalloc(dimension, sizeof(int), 0); memset(pos,0,sizeof(int)*dimension); while (*str != '\0' && (*str < '0' || *str > '9') && (*str != '*')) { str++; @@ -2133,7 +2133,7 @@ static int* get_position(int dimension, const char* str) { int *pos; - pos = safe_emalloc(sizeof(int), dimension, 0); + pos = safe_emalloc(dimension, sizeof(int), 0); get_position_ex(dimension, str, &pos); return pos; } @@ -2355,7 +2355,7 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod smart_str_appends(&array_type, value); } - dims = safe_emalloc(sizeof(int), dimension, 0); + dims = safe_emalloc(dimension, sizeof(int), 0); dims[0] = i; el = data; for (i = 1; i < dimension; i++) { @@ -2450,13 +2450,13 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod smart_str_append_long(&array_size, i); - dims = safe_emalloc(sizeof(int), dimension, 0); + dims = safe_emalloc(dimension, sizeof(int), 0); dims[0] = i; } else { enc = get_array_type(xmlParam, data, &array_type); smart_str_append_long(&array_size, i); - dims = safe_emalloc(sizeof(int), dimension, 0); + dims = safe_emalloc(dimension, sizeof(int), 0); dims[0] = i; } @@ -2660,7 +2660,7 @@ static zval *to_zval_array(zval *ret, encodeTypePtr type, xmlNodePtr data) dims = emalloc(sizeof(int)); *dims = 0; } - pos = safe_emalloc(sizeof(int), dimension, 0); + pos = safe_emalloc(dimension, sizeof(int), 0); memset(pos,0,sizeof(int)*dimension); if (data && (attr = get_soap_enc_attribute(data->properties,"offset")) && diff --git a/ext/soap/soap.c b/ext/soap/soap.c index 8d5fc9a694d2..df39d5f429dd 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -2763,7 +2763,7 @@ static void soap_client_call_common( zval *param; int i = 0; - real_args = safe_emalloc(sizeof(zval), arg_count, 0); + real_args = safe_emalloc(arg_count, sizeof(zval), 0); ZEND_HASH_FOREACH_VAL(args, param) { /*zval_add_ref(param);*/ ZVAL_DEREF(param); diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c index 9a86030ba019..88a24a7255bc 100644 --- a/ext/standard/basic_functions.c +++ b/ext/standard/basic_functions.c @@ -923,7 +923,7 @@ static int parse_opts(char * opts, opt_struct ** result) } } - paras = safe_emalloc(sizeof(opt_struct), count, 0); + paras = safe_emalloc(count, sizeof(opt_struct), 0); memset(paras, 0, sizeof(opt_struct) * count); *result = paras; while ( (*opts >= 48 && *opts <= 57) || /* 0 - 9 */ @@ -990,7 +990,7 @@ PHP_FUNCTION(getopt) /* Attempt to allocate enough memory to hold all of the arguments * and a trailing NULL */ - argv = (char **) safe_emalloc(sizeof(char *), (argc + 1), 0); + argv = (char **) safe_emalloc((argc + 1), sizeof(char *), 0); /* Iterate over the hash to construct the argv array. */ ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(args), entry) { diff --git a/ext/standard/proc_open.c b/ext/standard/proc_open.c index e63cdbb13e63..38eeb0aacc02 100644 --- a/ext/standard/proc_open.c +++ b/ext/standard/proc_open.c @@ -795,7 +795,7 @@ static zend_string* get_command_from_array(const HashTable *array, char ***argv, zend_string *command = NULL; uint32_t i = 0; - *argv = safe_emalloc(sizeof(char *), num_elems + 1, 0); + *argv = safe_emalloc(num_elems + 1, sizeof(char *), 0); ZEND_HASH_FOREACH_VAL(array, arg_zv) { zend_string *arg_str = get_valid_arg_string(arg_zv, i + 1); diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c index 5aeb585fea23..4a559547c029 100644 --- a/ext/standard/scanf.c +++ b/ext/standard/scanf.c @@ -161,9 +161,9 @@ static char * BuildCharSet(CharSet *cset, char *format) ch = end++; } - cset->chars = (char *) safe_emalloc(sizeof(char), (end - format - 1), 0); + cset->chars = (char *) safe_emalloc((end - format - 1), sizeof(char), 0); if (nranges > 0) { - cset->ranges = (struct Range *) safe_emalloc(sizeof(struct Range), nranges, 0); + cset->ranges = (struct Range *) safe_emalloc(nranges, sizeof(struct Range), 0); } else { cset->ranges = NULL; } @@ -317,7 +317,7 @@ PHPAPI int ValidateFormat(char *format, int numVars, int *totalSubs) * a variable is multiply assigned or left unassigned. */ if (numVars > nspace) { - nassign = (int*)safe_emalloc(sizeof(int), numVars, 0); + nassign = (int*)safe_emalloc(numVars, sizeof(int), 0); nspace = numVars; } for (i = 0; i < nspace; i++) { diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c index b699c12ed9ba..bc4ac90e2c16 100644 --- a/ext/standard/user_filters.c +++ b/ext/standard/user_filters.c @@ -351,7 +351,7 @@ static php_stream_filter *user_filter_factory_create(const char *filtername, TODO: Allow failed userfilter creations to continue scanning through the list */ if ((period = strrchr(filtername, '.'))) { - char *wildcard = safe_emalloc(len, 1, 3); + char *wildcard = safe_emalloc(len, sizeof(char), 3); /* Search for wildcard matches instead */ memcpy(wildcard, filtername, len + 1); /* copy \0 */ diff --git a/ext/standard/versioning.c b/ext/standard/versioning.c index dc7ca71af469..33d891671148 100644 --- a/ext/standard/versioning.c +++ b/ext/standard/versioning.c @@ -26,7 +26,7 @@ PHPAPI char * php_canonicalize_version(const char *version) { size_t len = strlen(version); - char *buf = safe_emalloc(len, 2, 1), *q, lp, lq; + char *buf = safe_emalloc(len * 2, sizeof(char), 1), *q, lp, lq; const char *p; if (len == 0) { diff --git a/main/streams/filter.c b/main/streams/filter.c index fdc5dfc00ad2..0cfb454ca929 100644 --- a/main/streams/filter.c +++ b/main/streams/filter.c @@ -230,7 +230,7 @@ PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, zval /* try a wildcard */ char *wildname; - wildname = safe_emalloc(1, n, 3); + wildname = safe_emalloc(n, sizeof(char), 3); memcpy(wildname, filtername, n+1); char *new_period = wildname + (period - filtername); while (new_period && !filter) { From 6479db9759328b456f65a03d885a96c8110a2b0b Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Fri, 30 Oct 2026 17:33:41 +0000 Subject: [PATCH 2/3] tree: use correct argument ordering for safe_erealloc() It is (ptr, nmemb, size, offset) not (ptr, size, nmemb, offset). --- Zend/zend_compile.c | 2 +- Zend/zend_ptr_stack.h | 2 +- Zend/zend_smart_str.c | 2 +- Zend/zend_string.h | 6 +++--- ext/standard/basic_functions.c | 2 +- ext/standard/browscap.c | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 20cfc4dead16..4ba5944db06b 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -1243,7 +1243,7 @@ static uint32_t zend_add_try_element(uint32_t try_op) /* {{{ */ zend_try_catch_element *elem; op_array->try_catch_array = safe_erealloc( - op_array->try_catch_array, sizeof(zend_try_catch_element), op_array->last_try_catch, 0); + op_array->try_catch_array, op_array->last_try_catch, sizeof(zend_try_catch_element), 0); elem = &op_array->try_catch_array[try_catch_offset]; elem->try_op = try_op; diff --git a/Zend/zend_ptr_stack.h b/Zend/zend_ptr_stack.h index 6a6376f79dae..e8179c02c93a 100644 --- a/Zend/zend_ptr_stack.h +++ b/Zend/zend_ptr_stack.h @@ -49,7 +49,7 @@ END_EXTERN_C() do { \ stack->max += PTR_STACK_BLOCK_SIZE; \ } while (stack->top+count > stack->max); \ - stack->elements = (void **) safe_perealloc(stack->elements, sizeof(void *), (stack->max), 0, stack->persistent); \ + stack->elements = (void **) safe_perealloc(stack->elements, (stack->max), sizeof(void *), 0, stack->persistent); \ stack->top_element = stack->elements+stack->top; \ } diff --git a/Zend/zend_smart_str.c b/Zend/zend_smart_str.c index d5ab0c9a43da..d28f3e66d8f5 100644 --- a/Zend/zend_smart_str.c +++ b/Zend/zend_smart_str.c @@ -73,7 +73,7 @@ static zend_always_inline bool i_smart_str_realloc(smart_str *str, size_t len, b ZSTR_LEN(str->s) = 0; } else { size_t a = SMART_STR_NEW_LEN(len); - zend_string *s = (zend_string *) safe_fperealloc(str->s, 1, a, _ZSTR_HEADER_SIZE + 1, /* persistent */ true, fallible); + zend_string *s = (zend_string *) safe_fperealloc(str->s, a, sizeof(char), _ZSTR_HEADER_SIZE + 1, /* persistent */ true, fallible); if (ZEND_CONST_COND(fallible, true) && !s) { return false; } diff --git a/Zend/zend_string.h b/Zend/zend_string.h index d2b2d1f3d855..5bd805aa8ddb 100644 --- a/Zend/zend_string.h +++ b/Zend/zend_string.h @@ -299,7 +299,7 @@ static zend_always_inline zend_string *zend_string_frealloc(zend_string *s, size if (!ZSTR_IS_INTERNED(s)) { if (EXPECTED(GC_REFCOUNT(s) == 1)) { - ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible); + ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible); if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) { return NULL; } @@ -331,7 +331,7 @@ static zend_always_inline zend_string *zend_string_fextend(zend_string *s, size_ ZEND_ASSERT(len >= ZSTR_LEN(s)); if (!ZSTR_IS_INTERNED(s)) { if (EXPECTED(GC_REFCOUNT(s) == 1)) { - ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible); + ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible); if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) { return NULL; } @@ -363,7 +363,7 @@ static zend_always_inline zend_string *zend_string_ftruncate(zend_string *s, siz ZEND_ASSERT(len <= ZSTR_LEN(s)); if (!ZSTR_IS_INTERNED(s)) { if (EXPECTED(GC_REFCOUNT(s) == 1)) { - ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible); + ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible); if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) { return NULL; } diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c index 88a24a7255bc..8014705418a4 100644 --- a/ext/standard/basic_functions.c +++ b/ext/standard/basic_functions.c @@ -1020,7 +1020,7 @@ PHP_FUNCTION(getopt) /* the first slots are filled by the one short ops * we now extend our array and jump to the new added structs */ - opts = (opt_struct *) safe_erealloc(opts, sizeof(opt_struct), (len + count + 1), 0); + opts = (opt_struct *) safe_erealloc(opts, (len + count + 1), sizeof(opt_struct), 0); orig_opts = opts; opts += len; diff --git a/ext/standard/browscap.c b/ext/standard/browscap.c index 016b09e9c109..f636126f4edd 100644 --- a/ext/standard/browscap.c +++ b/ext/standard/browscap.c @@ -255,7 +255,7 @@ static void browscap_add_kv( browser_data *bdata, zend_string *key, zend_string *value, bool persistent) { if (bdata->kv_used == bdata->kv_size) { bdata->kv_size *= 2; - bdata->kv = safe_perealloc(bdata->kv, sizeof(browscap_kv), bdata->kv_size, 0, persistent); + bdata->kv = safe_perealloc(bdata->kv, bdata->kv_size, sizeof(browscap_kv), 0, persistent); } bdata->kv[bdata->kv_used].key = key; From 50eac7863b64d56537017e3a2ba270b40f2d1e8a Mon Sep 17 00:00:00 2001 From: Gina Peter Banyard Date: Fri, 30 Oct 2026 18:04:35 +0000 Subject: [PATCH 3/3] tree: use correct argument ordering for ecalloc() It is (nmemb, size) not (size, nmemb). Use sizeof(char) instead of literal 1 in some cases --- ext/intl/locale/locale_methods.cpp | 10 +++++----- ext/openssl/openssl_backend_common.c | 2 +- ext/pdo/pdo_dbh.c | 2 +- ext/pdo_firebird/firebird_statement.c | 7 +++---- ext/phar/tar.c | 2 +- ext/sockets/multicast.c | 2 +- ext/spl/spl_heap.c | 2 +- ext/standard/image.c | 2 +- ext/standard/proc_open.c | 4 ++-- main/rfc1867.c | 2 +- 10 files changed, 17 insertions(+), 18 deletions(-) diff --git a/ext/intl/locale/locale_methods.cpp b/ext/intl/locale/locale_methods.cpp index 5fd89c62f157..121265b48626 100644 --- a/ext/intl/locale/locale_methods.cpp +++ b/ext/intl/locale/locale_methods.cpp @@ -1397,7 +1397,7 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches) } /* Convert to lower case for case-insensitive comparison */ - cur_lang_tag = std::unique_ptr(reinterpret_cast(ecalloc( 1, can_lang_tag->len + 1))); + cur_lang_tag = std::unique_ptr(reinterpret_cast(ecalloc(can_lang_tag->len + 1, sizeof(char)))); char *p_cur_lang_tag = cur_lang_tag.get(); /* Convert to lower case for case-insensitive comparison */ @@ -1407,7 +1407,7 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches) RETURN_FALSE; } - cur_loc_range = std::unique_ptr(reinterpret_cast(ecalloc( 1, can_loc_range->len + 1))); + cur_loc_range = std::unique_ptr(reinterpret_cast(ecalloc(can_loc_range->len + 1, sizeof(char)))); char *p_cur_loc_range = cur_loc_range.get(); result = strToMatch( can_loc_range->val , p_cur_loc_range ); if( result == 0) { @@ -1437,14 +1437,14 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches) } /* end of if isCanonical */ else{ /* Convert to lower case for case-insensitive comparison */ - cur_lang_tag = std::unique_ptr(reinterpret_cast(ecalloc(1, lang_tag_len + 1))); + cur_lang_tag = std::unique_ptr(reinterpret_cast(ecalloc(lang_tag_len + 1, sizeof(char)))); char *p_cur_lang_tag = cur_lang_tag.get(); result = strToMatch( lang_tag , p_cur_lang_tag); if( result == 0) { RETURN_FALSE; } - cur_loc_range = std::unique_ptr(reinterpret_cast(ecalloc(1, loc_range_len + 1))); + cur_loc_range = std::unique_ptr(reinterpret_cast(ecalloc(loc_range_len + 1, sizeof(char)))); char *p_cur_loc_range = cur_loc_range.get(); result = strToMatch( loc_range , p_cur_loc_range ); if( result == 0) { @@ -1561,7 +1561,7 @@ static zend_string* lookup_loc_range(const char* loc_range, HashTable* hash_arr, } } - cur_loc_range = reinterpret_cast(ecalloc(1, strlen(loc_range)+1)); + cur_loc_range = reinterpret_cast(ecalloc(strlen(loc_range)+1, sizeof(char))); /* convert to lower and replace hyphens */ result = strToMatch(loc_range, cur_loc_range); if(can_loc_range) { diff --git a/ext/openssl/openssl_backend_common.c b/ext/openssl/openssl_backend_common.c index 995d836deead..62a8350f75c2 100644 --- a/ext/openssl/openssl_backend_common.c +++ b/ext/openssl/openssl_backend_common.c @@ -1727,7 +1727,7 @@ zend_result php_openssl_validate_iv(const char **piv, size_t *piv_len, size_t iv return SUCCESS; } - iv_new = ecalloc(1, iv_required_len + 1); + iv_new = ecalloc(iv_required_len + 1, sizeof(char)); if (*piv_len == 0) { /* BC behavior */ diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c index 35c0767d99a5..d5bb95a76309 100644 --- a/ext/pdo/pdo_dbh.c +++ b/ext/pdo/pdo_dbh.c @@ -1399,7 +1399,7 @@ bool pdo_hash_methods(pdo_dbh_object_t *dbh_obj, int kind) func.function_name = zend_string_init(funcs->fname, strlen(funcs->fname), dbh->is_persistent); func.scope = pdo_dbh_ce; func.prototype = NULL; - ZEND_MAP_PTR(func.run_time_cache) = rt_cache_size ? pecalloc(rt_cache_size, 1, dbh->is_persistent) : NULL; + ZEND_MAP_PTR(func.run_time_cache) = rt_cache_size ? pecalloc(1, rt_cache_size, dbh->is_persistent) : NULL; func.T = ZEND_OBSERVER_ENABLED; if (funcs->flags) { func.fn_flags = funcs->flags | ZEND_ACC_NEVER_CACHE; diff --git a/ext/pdo_firebird/firebird_statement.c b/ext/pdo_firebird/firebird_statement.c index f1e60e25b41b..1d3edd20d9f8 100644 --- a/ext/pdo_firebird/firebird_statement.c +++ b/ext/pdo_firebird/firebird_statement.c @@ -195,14 +195,13 @@ static int pdo_firebird_stmt_execute(pdo_stmt_t *stmt) /* {{{ */ /* allocate storage for the output data */ if (S->out_sqlda.sqld) { - unsigned int i; - for (i = 0; i < S->out_sqlda.sqld; i++) { + for (ISC_SHORT i = 0; i < S->out_sqlda.sqld; i++) { XSQLVAR *var = &S->out_sqlda.sqlvar[i]; if (var->sqlind) { efree(var->sqlind); } - var->sqlind = (void*)ecalloc(1, var->sqllen + 2 * sizeof(short)); - var->sqldata = &((char*)var->sqlind)[sizeof(short)]; + var->sqlind = (void*)ecalloc(var->sqllen + 2, sizeof(ISC_SHORT)); + var->sqldata = &((char*)var->sqlind)[sizeof(ISC_SHORT)]; } } diff --git a/ext/phar/tar.c b/ext/phar/tar.c index 3c9e155541eb..e2d6165b9898 100644 --- a/ext/phar/tar.c +++ b/ext/phar/tar.c @@ -1318,7 +1318,7 @@ ZEND_ATTRIBUTE_NONNULL_ARGS(1, 4) int phar_tar_flush(phar_archive_data *phar, ze } /* signature */ /* add final zero blocks */ - buf = (char *) ecalloc(1024, 1); + buf = (char *) ecalloc(1024, sizeof(char)); php_stream_write(newfile, buf, 1024); efree(buf); diff --git a/ext/sockets/multicast.c b/ext/sockets/multicast.c index 9ff7eb0b136a..0afacd2ecce3 100644 --- a/ext/sockets/multicast.c +++ b/ext/sockets/multicast.c @@ -777,7 +777,7 @@ zend_result php_add4_to_if_index(struct in_addr *addr, php_socket *php_sock, uns for(;;) { size += 5 * sizeof(struct ifreq); - buf = ecalloc(size, 1); + buf = ecalloc(size, sizeof(char)); if_conf.ifc_len = size; if_conf.ifc_buf = buf; diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c index 74298a04c947..d21ef76c47ad 100644 --- a/ext/spl/spl_heap.c +++ b/ext/spl/spl_heap.c @@ -251,7 +251,7 @@ static spl_ptr_heap *spl_ptr_heap_init(spl_ptr_heap_cmp_func cmp, spl_ptr_heap_c heap->dtor = dtor; heap->ctor = ctor; heap->cmp = cmp; - heap->elements = ecalloc(PTR_HEAP_BLOCK_SIZE, elem_size); + heap->elements = ecalloc(elem_size, PTR_HEAP_BLOCK_SIZE); heap->max_size = PTR_HEAP_BLOCK_SIZE; heap->count = 0; heap->flags = 0; diff --git a/ext/standard/image.c b/ext/standard/image.c index 66fc4156a9b4..ff07f5a3874e 100644 --- a/ext/standard/image.c +++ b/ext/standard/image.c @@ -174,7 +174,7 @@ static struct php_gfxinfo *php_handle_swc(php_stream * stream) return NULL; } - b = ecalloc(1, len + 1); + b = ecalloc(len + 1, sizeof(unsigned char)); if (uncompress(b, &len, a, sizeof(a)) != Z_OK) { /* failed to decompress the file, will try reading the rest of the file */ diff --git a/ext/standard/proc_open.c b/ext/standard/proc_open.c index 38eeb0aacc02..cbd2f488c346 100644 --- a/ext/standard/proc_open.c +++ b/ext/standard/proc_open.c @@ -175,7 +175,7 @@ ZEND_ATTRIBUTE_NONNULL static php_process_env php_array_to_envp(const HashTable #ifndef PHP_WIN32 env.envarray = (char **) ecalloc(1, sizeof(char *)); #endif - env.envp = (char *) ecalloc(4, 1); + env.envp = (char *) ecalloc(4, sizeof(char)); return env; } @@ -204,7 +204,7 @@ ZEND_ATTRIBUTE_NONNULL static php_process_env php_array_to_envp(const HashTable #ifndef PHP_WIN32 ep = env.envarray = (char **) ecalloc(cnt + 1, sizeof(char *)); #endif - p = env.envp = (char *) ecalloc(sizeenv + 4, 1); + p = env.envp = (char *) ecalloc(sizeenv + 4, sizeof(char)); ZEND_HASH_FOREACH_STR_KEY_PTR(env_hash, key, str) { #ifndef PHP_WIN32 diff --git a/main/rfc1867.c b/main/rfc1867.c index ea9446bd0f77..334d0dd877ef 100644 --- a/main/rfc1867.c +++ b/main/rfc1867.c @@ -265,7 +265,7 @@ static multipart_buffer *multipart_buffer_new(char *boundary, int boundary_len) int minsize = boundary_len + 6; if (minsize < FILLUNIT) minsize = FILLUNIT; - self->buffer = (char *) ecalloc(1, minsize + 1); + self->buffer = (char *) ecalloc(minsize + 1, sizeof(char)); self->bufsize = minsize; spprintf(&self->boundary, 0, "--%s", boundary);