tree: use correct argument order for allocation functions

Zend/Optimizer/compact_vars.c

@@ -96,7 +96,7 @@ void zend_optimizer_compact_vars(zend_op_array *op_array) {
 	/* Update CV name table */
 	if (num_cvs != op_array->last_var) {
 		if (num_cvs) {
-			zend_string **names = safe_emalloc(sizeof(zend_string *), num_cvs, 0);
+			zend_string **names = safe_emalloc(num_cvs, sizeof(zend_string *), 0);
 			for (i = 0; i < op_array->last_var; i++) {
 				if (vars_map[i] != (uint32_t) -1) {
 					names[vars_map[i]] = op_array->vars[i];

Zend/zend_compile.c

@@ -1243,7 +1243,7 @@ static uint32_t zend_add_try_element(uint32_t try_op) /* {{{ */
 	zend_try_catch_element *elem;
 
 	op_array->try_catch_array = safe_erealloc(
-		op_array->try_catch_array, sizeof(zend_try_catch_element), op_array->last_try_catch, 0);
+		op_array->try_catch_array, op_array->last_try_catch, sizeof(zend_try_catch_element), 0);
 
 	elem = &op_array->try_catch_array[try_catch_offset];
 	elem->try_op = try_op;
@@ -5208,7 +5208,7 @@ static zend_result zend_compile_func_sprintf(znode *result, zend_ast_list *args)
 	znode *elements = NULL;
 
 	if (placeholder_count > 0) {
-		elements = safe_emalloc(sizeof(*elements), placeholder_count, 0);
+		elements = safe_emalloc(placeholder_count, sizeof(*elements), 0);
 	}
 
 	/* Compile the value expressions first for error handling that is consistent
@@ -6816,7 +6816,7 @@ static void zend_compile_if(zend_ast *ast) /* {{{ */
 	uint32_t *jmp_opnums = NULL;
 
 	if (list->children > 1) {
-		jmp_opnums = safe_emalloc(sizeof(uint32_t), list->children - 1, 0);
+		jmp_opnums = safe_emalloc(list->children - 1, sizeof(uint32_t), 0);
 	}
 
 	for (i = 0; i < list->children; ++i) {
@@ -6956,7 +6956,7 @@ static void zend_compile_switch(zend_ast *ast) /* {{{ */
 		opnum_switch = opline - CG(active_op_array)->opcodes;
 	}
 
-	jmpnz_opnums = safe_emalloc(sizeof(uint32_t), cases->children, 0);
+	jmpnz_opnums = safe_emalloc(cases->children, sizeof(uint32_t), 0);
 	for (i = 0; i < cases->children; ++i) {
 		zend_ast *case_ast = cases->child[i];
 		zend_ast *cond_ast = case_ast->child[0];
@@ -7294,7 +7294,7 @@ static void zend_compile_match(znode *result, zend_ast *ast)
 		}
 		opnum_match = opline - CG(active_op_array)->opcodes;
 	} else {
-		jmpnz_opnums = safe_emalloc(sizeof(uint32_t), num_conds, 0);
+		jmpnz_opnums = safe_emalloc(num_conds, sizeof(uint32_t), 0);
 		uint32_t cond_count = 0;
 		for (uint32_t i = 0; i < arms->children; ++i) {
 			zend_ast *arm_ast = arms->child[i];
@@ -7331,7 +7331,7 @@ static void zend_compile_match(znode *result, zend_ast *ast)
 
 	bool is_first_case = true;
 	uint32_t cond_count = 0;
-	uint32_t *jmp_end_opnums = safe_emalloc(sizeof(uint32_t), arms->children, 0);
+	uint32_t *jmp_end_opnums = safe_emalloc(arms->children, sizeof(uint32_t), 0);
 
 	// The generated default arm is emitted first to avoid live range issues where the tmpvar
 	// for the arm result is freed even though it has not been initialized yet.
@@ -7441,7 +7441,7 @@ static void zend_compile_try(const zend_ast *ast) /* {{{ */
 	uint32_t i, j;
 	zend_op *opline;
 	uint32_t try_catch_offset;
-	uint32_t *jmp_opnums = safe_emalloc(sizeof(uint32_t), catches->children, 0);
+	uint32_t *jmp_opnums = safe_emalloc(catches->children, sizeof(uint32_t), 0);
 	uint32_t orig_fast_call_var = CG(context).fast_call_var;
 	uint32_t orig_try_catch_offset = CG(context).try_catch_offset;
 
@@ -7493,7 +7493,7 @@ static void zend_compile_try(const zend_ast *ast) /* {{{ */
 		zend_string *var_name = var_ast ? zval_make_interned_string(zend_ast_get_zval(var_ast)) : NULL;
 		bool is_last_catch = (i + 1 == catches->children);
 
-		uint32_t *jmp_multicatch = safe_emalloc(sizeof(uint32_t), classes->children - 1, 0);
+		uint32_t *jmp_multicatch = safe_emalloc(classes->children - 1, sizeof(uint32_t), 0);
 		uint32_t opnum_catch = (uint32_t)-1;
 
 		CG(zend_lineno) = catch_ast->lineno;
@@ -8440,7 +8440,7 @@ static void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast, uint32
 
 	if (return_type_ast || fallback_return_type) {
 		/* Use op_array->arg_info[-1] for return type */
-		arg_infos = safe_emalloc(sizeof(zend_arg_info), list->children + 1, 0);
+		arg_infos = safe_emalloc(list->children + 1, sizeof(zend_arg_info), 0);
 		arg_infos->name = NULL;
 		if (return_type_ast) {
 			arg_infos->type = zend_compile_typename(return_type_ast);
@@ -8463,7 +8463,7 @@ static void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast, uint32
 		if (list->children == 0) {
 			return;
 		}
-		arg_infos = safe_emalloc(sizeof(zend_arg_info), list->children, 0);
+		arg_infos = safe_emalloc(list->children, sizeof(zend_arg_info), 0);
 	}
 
 	/* Find last required parameter number for deprecation message. */

Zend/zend_ptr_stack.h

@@ -49,7 +49,7 @@ END_EXTERN_C()
 		do {												\
 			stack->max += PTR_STACK_BLOCK_SIZE;				\
 		} while (stack->top+count > stack->max);			\
-		stack->elements = (void **) safe_perealloc(stack->elements, sizeof(void *), (stack->max), 0, stack->persistent);	\
+		stack->elements = (void **) safe_perealloc(stack->elements, (stack->max), sizeof(void *), 0, stack->persistent);	\
 		stack->top_element = stack->elements+stack->top;	\
 	}
 

Zend/zend_smart_str.c

@@ -73,7 +73,7 @@ static zend_always_inline bool i_smart_str_realloc(smart_str *str, size_t len, b
 		ZSTR_LEN(str->s) = 0;
 	} else {
 		size_t a = SMART_STR_NEW_LEN(len);
-		zend_string *s = (zend_string *) safe_fperealloc(str->s, 1, a, _ZSTR_HEADER_SIZE + 1, /* persistent */ true, fallible);
+		zend_string *s = (zend_string *) safe_fperealloc(str->s, a, sizeof(char), _ZSTR_HEADER_SIZE + 1, /* persistent */ true, fallible);
 		if (ZEND_CONST_COND(fallible, true) && !s) {
 			return false;
 		}

Zend/zend_stream.c

@@ -160,7 +160,7 @@ ZEND_API zend_result zend_stream_fixup(zend_file_handle *file_handle, char **buf
 	if (file_size) {
 		ssize_t read;
 		size_t size = 0;
-		*buf = safe_emalloc(1, file_size, ZEND_MMAP_AHEAD);
+		*buf = safe_emalloc(file_size, sizeof(char), ZEND_MMAP_AHEAD);
 		while ((read = zend_stream_read(file_handle, *buf + size, file_size - size)) > 0) {
 			size += read;
 		}

Zend/zend_string.h

@@ -299,7 +299,7 @@ static zend_always_inline zend_string *zend_string_frealloc(zend_string *s, size
 
 	if (!ZSTR_IS_INTERNED(s)) {
 		if (EXPECTED(GC_REFCOUNT(s) == 1)) {
-			ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
+			ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
 			if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) {
 				return NULL;
 			}
@@ -331,7 +331,7 @@ static zend_always_inline zend_string *zend_string_fextend(zend_string *s, size_
 	ZEND_ASSERT(len >= ZSTR_LEN(s));
 	if (!ZSTR_IS_INTERNED(s)) {
 		if (EXPECTED(GC_REFCOUNT(s) == 1)) {
-			ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
+			ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
 			if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) {
 				return NULL;
 			}
@@ -363,7 +363,7 @@ static zend_always_inline zend_string *zend_string_ftruncate(zend_string *s, siz
 	ZEND_ASSERT(len <= ZSTR_LEN(s));
 	if (!ZSTR_IS_INTERNED(s)) {
 		if (EXPECTED(GC_REFCOUNT(s) == 1)) {
-			ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
+			ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
 			if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) {
 				return NULL;
 			}
@@ -420,7 +420,7 @@ static zend_always_inline zend_string *zend_string_safe_realloc(zend_string *s,
 }
 
 static zend_always_inline char *zend_cstr_append_char(const char *str, size_t len, char c) {
-	char *res = (char *)safe_emalloc(len, 1, 2);
+	char *res = (char *)safe_emalloc(len, sizeof(char), 2);
 	if (len > 0) {
 		memcpy(res, str, len);
 	}

ext/hash/hash.c

@@ -1039,7 +1039,7 @@ PHP_FUNCTION(hash_pbkdf2)
 
 	result = safe_emalloc(loops, ops->digest_size, 0);
 
-	computed_salt = safe_emalloc(salt_len, 1, 4);
+	computed_salt = safe_emalloc(salt_len, sizeof(unsigned char), 4);
 	memcpy(computed_salt, (unsigned char *) salt, salt_len);
 
 	for (i = 1; i <= loops; i++) {

ext/intl/converter/converter.cpp

@@ -609,7 +609,7 @@ static zend_string* php_converter_do_convert(UConverter *dest_cnv,
 		THROW_UFAILURE(objval, error);
 		return nullptr;
 	}
-	temp = reinterpret_cast<UChar *>(safe_femalloc(sizeof(UChar), temp_len, sizeof(UChar), /* fallible */ true));
+	temp = reinterpret_cast<UChar *>(safe_femalloc(temp_len, sizeof(UChar), sizeof(UChar), /* fallible */ true));
 	if (!temp) {
 		return NULL;
 	}

ext/intl/locale/locale_methods.cpp

@@ -1397,7 +1397,7 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches)
 		}
 
 		/* Convert to lower case for case-insensitive comparison */
-		cur_lang_tag = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc( 1, can_lang_tag->len + 1)));
+		cur_lang_tag = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(can_lang_tag->len + 1, sizeof(char))));
 		char *p_cur_lang_tag = cur_lang_tag.get();
 
 		/* Convert to lower case for case-insensitive comparison */
@@ -1407,7 +1407,7 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches)
 			RETURN_FALSE;
 		}
 
-		cur_loc_range = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc( 1, can_loc_range->len + 1)));
+		cur_loc_range = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(can_loc_range->len + 1, sizeof(char))));
 		char *p_cur_loc_range = cur_loc_range.get();
 		result = strToMatch( can_loc_range->val , p_cur_loc_range );
 		if( result == 0) {
@@ -1437,14 +1437,14 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches)
 	} /* end of if isCanonical */
 	else{
 		/* Convert to lower case for case-insensitive comparison */
-		cur_lang_tag = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(1, lang_tag_len + 1)));
+		cur_lang_tag = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(lang_tag_len + 1, sizeof(char))));
 		char *p_cur_lang_tag = cur_lang_tag.get();
 
 		result = strToMatch( lang_tag , p_cur_lang_tag);
 		if( result == 0) {
 			RETURN_FALSE;
 		}
-		cur_loc_range = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(1, loc_range_len + 1)));
+		cur_loc_range = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(loc_range_len + 1, sizeof(char))));
 		char *p_cur_loc_range = cur_loc_range.get();
 		result = strToMatch( loc_range , p_cur_loc_range );
 		if( result == 0) {
@@ -1561,7 +1561,7 @@ static zend_string* lookup_loc_range(const char* loc_range, HashTable* hash_arr,
 		}
 	}
 
-	cur_loc_range = reinterpret_cast<char *>(ecalloc(1, strlen(loc_range)+1));
+	cur_loc_range = reinterpret_cast<char *>(ecalloc(strlen(loc_range)+1, sizeof(char)));
 	/* convert to lower and replace hyphens */
 	result = strToMatch(loc_range, cur_loc_range);
 	if(can_loc_range) {

ext/intl/msgformat/msgformat_data.cpp

@@ -68,7 +68,7 @@ void msgformat_data_free(msgformat_data* mf_data)
 int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec)
 {
 	if(*spattern && *spattern_len && u_strchr(*spattern, (UChar)'\'')) {
-		UChar *npattern = safe_emalloc(sizeof(UChar)*2, *spattern_len, sizeof(UChar));
+		UChar *npattern = safe_emalloc(*spattern_len, sizeof(UChar)*2, sizeof(UChar));
 		uint32_t npattern_len;
 		npattern_len = umsg_autoQuoteApostrophe(*spattern, *spattern_len, npattern, 2*(*spattern_len)+1, ec);
 		efree(*spattern);

ext/intl/uchar/uchar.cpp

@@ -544,7 +544,7 @@ IC_METHOD(getFC_NFKC_Closure) {
 	if (closure_len == 0) {
 		RETURN_EMPTY_STRING();
 	}
-	closure = reinterpret_cast<UChar *>(safe_emalloc(sizeof(UChar), closure_len + 1, 0));
+	closure = reinterpret_cast<UChar *>(safe_emalloc(closure_len + 1, sizeof(UChar), 0));
 	error = U_ZERO_ERROR;
 	closure_len = u_getFC_NFKC_Closure(cp, closure, closure_len, &error);
 	if (U_FAILURE(error)) {

ext/odbc/php_odbc.c

@@ -684,7 +684,7 @@ void odbc_bindcols(odbc_result *result)
 	SQLLEN      	displaysize;
 	SQLUSMALLINT	colfieldid;
 
-	result->values = (odbc_result_value *) safe_emalloc(sizeof(odbc_result_value), result->numcols, 0);
+	result->values = (odbc_result_value *) safe_emalloc(result->numcols, sizeof(odbc_result_value), 0);
 
 	result->longreadlen = ODBCG(defaultlrl);
 	result->binmode = ODBCG(defaultbinmode);
@@ -954,7 +954,7 @@ PHP_FUNCTION(odbc_prepare)
 	result->fetched = 0;
 	odbc_insert_new_result(conn, return_value);
 
-	result->param_info = (odbc_param_info *) safe_emalloc(sizeof(odbc_param_info), result->numparams, 0);
+	result->param_info = (odbc_param_info *) safe_emalloc(result->numparams, sizeof(odbc_param_info), 0);
 	for (i=0;i<result->numparams;i++) {
 		rc = SQLDescribeParam(result->stmt, (SQLUSMALLINT)(i+1), &result->param_info[i].sqltype, &result->param_info[i].precision,
 													&result->param_info[i].scale, &result->param_info[i].nullable);
@@ -1017,7 +1017,7 @@ PHP_FUNCTION(odbc_execute)
 			RETURN_FALSE;
 		}
 
-		params = (odbc_params_t *)safe_emalloc(sizeof(odbc_params_t), result->numparams, 0);
+		params = (odbc_params_t *)safe_emalloc(result->numparams, sizeof(odbc_params_t), 0);
 		for(i = 0; i < result->numparams; i++) {
 			params[i].fp = -1;
 			params[i].zstr = NULL;

ext/openssl/openssl_backend_common.c

@@ -1727,7 +1727,7 @@ zend_result php_openssl_validate_iv(const char **piv, size_t *piv_len, size_t iv
 		return SUCCESS;
 	}
 
-	iv_new = ecalloc(1, iv_required_len + 1);
+	iv_new = ecalloc(iv_required_len + 1, sizeof(char));
 
 	if (*piv_len == 0) {
 		/* BC behavior */

ext/pdo/pdo_dbh.c

@@ -1399,7 +1399,7 @@ bool pdo_hash_methods(pdo_dbh_object_t *dbh_obj, int kind)
 		func.function_name = zend_string_init(funcs->fname, strlen(funcs->fname), dbh->is_persistent);
 		func.scope = pdo_dbh_ce;
 		func.prototype = NULL;
-		ZEND_MAP_PTR(func.run_time_cache) = rt_cache_size ? pecalloc(rt_cache_size, 1, dbh->is_persistent) : NULL;
+		ZEND_MAP_PTR(func.run_time_cache) = rt_cache_size ? pecalloc(1, rt_cache_size, dbh->is_persistent) : NULL;
 		func.T = ZEND_OBSERVER_ENABLED;
 		if (funcs->flags) {
 			func.fn_flags = funcs->flags | ZEND_ACC_NEVER_CACHE;

ext/pdo/pdo_stmt.c

@@ -825,7 +825,7 @@ static bool do_fetch(pdo_stmt_t *stmt, zval *return_value, enum pdo_fetch_type h
 			}
 			/* There will be at most stmt->column_count parameters.
 			 * However, if we fetch a group key we will have over allocated. */
-			fetch_function_params = safe_emalloc(sizeof(zval), stmt->column_count, 0);
+			fetch_function_params = safe_emalloc(stmt->column_count, sizeof(zval), 0);
 			break;
 		default: ZEND_UNREACHABLE();
 	}

ext/pdo_firebird/firebird_statement.c

@@ -195,14 +195,13 @@ static int pdo_firebird_stmt_execute(pdo_stmt_t *stmt) /* {{{ */
 
 		/* allocate storage for the output data */
 		if (S->out_sqlda.sqld) {
-			unsigned int i;
-			for (i = 0; i < S->out_sqlda.sqld; i++) {
+			for (ISC_SHORT i = 0; i < S->out_sqlda.sqld; i++) {
 				XSQLVAR *var = &S->out_sqlda.sqlvar[i];
 				if (var->sqlind) {
 					efree(var->sqlind);
 				}
-				var->sqlind = (void*)ecalloc(1, var->sqllen + 2 * sizeof(short));
-				var->sqldata = &((char*)var->sqlind)[sizeof(short)];
+				var->sqlind = (void*)ecalloc(var->sqllen + 2, sizeof(ISC_SHORT));
+				var->sqldata = &((char*)var->sqlind)[sizeof(ISC_SHORT)];
 			}
 		}
 

ext/pdo_pgsql/pgsql_driver.c

@@ -451,7 +451,7 @@ static zend_string* pgsql_handle_quoter(pdo_dbh_t *dbh, const zend_string *unquo
 			PQfreemem(escaped);
 			break;
 		default:
-			quoted = safe_emalloc(2, ZSTR_LEN(unquoted), 3);
+			quoted = safe_emalloc(ZSTR_LEN(unquoted) * 2, sizeof(char), 3);
 			quoted[0] = '\'';
 			quotedlen = PQescapeStringConn(H->server, quoted + 1, ZSTR_VAL(unquoted), ZSTR_LEN(unquoted), &err);
 			if (err) {

ext/pdo_sqlite/sqlite_driver.c

@@ -237,7 +237,7 @@ static zend_string* sqlite_handle_quoter(pdo_dbh_t *dbh, const zend_string *unqu
 		return NULL;
 	}
 
-	quoted = safe_emalloc(2, ZSTR_LEN(unquoted), 3);
+	quoted = safe_emalloc(ZSTR_LEN(unquoted) * 2, sizeof(char), 3);
 	/* TODO use %Q format? */
 	sqlite3_snprintf(2*ZSTR_LEN(unquoted) + 3, quoted, "'%q'", ZSTR_VAL(unquoted));
 	zend_string *quoted_str = zend_string_init(quoted, strlen(quoted), 0);

ext/pgsql/pgsql.c

@@ -1217,7 +1217,7 @@ static char **php_pgsql_make_arguments(const HashTable *param_arr, int *num_para
 {
 	/* This conversion is safe because of the limit of number of elements in a table. */
 	*num_params = (int) zend_hash_num_elements(param_arr);
-	char **params = safe_emalloc(sizeof(char *), *num_params, 0);
+	char **params = safe_emalloc(*num_params, sizeof(char *), 0);
 	uint32_t i = 0;
 
 	ZEND_HASH_FOREACH_VAL(param_arr, zval *tmp) {
@@ -4570,7 +4570,7 @@ PHP_PGSQL_API zend_result php_pgsql_meta_data(PGconn *pg_link, const zend_string
 						  "WHERE a.attnum > 0 AND c.relname = '");
 	}
 	len = strlen(tmp_name2);
-	escaped = (char *)safe_emalloc(len, 2, 1);
+	escaped = (char *)safe_emalloc(len * 2, sizeof(char), 1);
 	new_len = PQescapeStringConn(pg_link, escaped, tmp_name2, len, &err);
 	if (err) {
 		php_error_docref(NULL, E_WARNING, "Escaping table name '%s' failed", ZSTR_VAL(table_name));
@@ -4586,7 +4586,7 @@ PHP_PGSQL_API zend_result php_pgsql_meta_data(PGconn *pg_link, const zend_string
 
 	smart_str_appends(&querystr, "' AND n.nspname = '");
 	len = strlen(tmp_name);
-	escaped = (char *)safe_emalloc(len, 2, 1);
+	escaped = (char *)safe_emalloc(len * 2, sizeof(char), 1);
 	new_len = PQescapeStringConn(pg_link, escaped, tmp_name, len, &err);
 	if (err) {
 		php_error_docref(NULL, E_WARNING, "Escaping table namespace '%s' failed", ZSTR_VAL(table_name));
@@ -5640,7 +5640,7 @@ PHP_PGSQL_API zend_result php_pgsql_insert(PGconn *pg_link, const zend_string *t
 			case IS_STRING:
 				if (opt & PGSQL_DML_ESCAPE) {
 					int error;
-					char *tmp = safe_emalloc(Z_STRLEN_P(val), 2, 1);
+					char *tmp = safe_emalloc(Z_STRLEN_P(val) * 2, sizeof(char), 1);
 					size_t new_len = PQescapeStringConn(pg_link, tmp, Z_STRVAL_P(val), Z_STRLEN_P(val), &error);
 					if (error) {
 						php_error_docref(NULL, E_NOTICE, "Failed to escape field '%s' value", ZSTR_VAL(fld));
@@ -5824,7 +5824,7 @@ static inline int build_assignment_string(PGconn *pg_link, smart_str *querystr,
 			case IS_STRING:
 				if (opt & PGSQL_DML_ESCAPE) {
 					int error;
-					char *tmp = (char *)safe_emalloc(Z_STRLEN_P(val), 2, 1);
+					char *tmp = (char *)safe_emalloc(Z_STRLEN_P(val) * 2, sizeof(char), 1);
 					size_t new_len = PQescapeStringConn(pg_link, tmp, Z_STRVAL_P(val), Z_STRLEN_P(val), &error);
 					if (error) {
 						php_error_docref(NULL, E_NOTICE, "Failed to escape field '%s' value", ZSTR_VAL(fld));

ext/phar/tar.c

@@ -212,7 +212,7 @@ static zend_result phar_tar_process_metadata(phar_entry_info *entry, php_stream
 	size_t save = php_stream_tell(fp), read;
 	phar_entry_info *mentry;
 
-	metadata = (char *) safe_emalloc(1, entry->uncompressed_filesize, 1);
+	metadata = (char *) safe_emalloc(entry->uncompressed_filesize, sizeof(char), 1);
 
 	read = php_stream_read(fp, metadata, entry->uncompressed_filesize);
 	if (read != entry->uncompressed_filesize) {
@@ -1318,7 +1318,7 @@ ZEND_ATTRIBUTE_NONNULL_ARGS(1, 4) int phar_tar_flush(phar_archive_data *phar, ze
 	} /* signature */
 
 	/* add final zero blocks */
-	buf = (char *) ecalloc(1024, 1);
+	buf = (char *) ecalloc(1024, sizeof(char));
 	php_stream_write(newfile, buf, 1024);
 	efree(buf);