From 5edfc636be4afa8a7ec9aba402881cbad6acb080 Mon Sep 17 00:00:00 2001 From: Volker Dusch Date: Thu, 13 Aug 2026 18:29:53 +0200 Subject: [PATCH] Keep EG(errors) buffer consistent on alloc failure Update the error count only after the buffer has been resized and the new entry initialized. This prevents fatal error handling from reading past the buffer if reallocating it triggers an OOM bailout. --- Zend/zend.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Zend/zend.c b/Zend/zend.c index e58566541dd2..aaa5d3908586 100644 --- a/Zend/zend.c +++ b/Zend/zend.c @@ -1486,9 +1486,10 @@ ZEND_API ZEND_COLD void zend_error_zstr_at( /* This is very inefficient for a large number of errors. * Use pow2 realloc if it becomes a problem. */ - EG(num_errors)++; - EG(errors) = erealloc(EG(errors), sizeof(zend_error_info*) * EG(num_errors)); - EG(errors)[EG(num_errors)-1] = info; + uint32_t new_num_errors = EG(num_errors) + 1; + EG(errors) = erealloc(EG(errors), sizeof(zend_error_info*) * new_num_errors); + EG(errors)[EG(num_errors)] = info; + EG(num_errors) = new_num_errors; /* Do not process non-fatal recorded error */ if (!(type & E_FATAL_ERRORS) || (type & E_DONT_BAIL)) {