@@ -127,8 +127,6 @@ END_EXTERN_C()
127127
128128/*---*/
129129
130- static zend_always_inline void * zend_mempcpy (void * dest , const void * src , size_t n );
131-
132130static zend_always_inline zend_ulong zend_string_hash_val (zend_string * s )
133131{
134132 return ZSTR_H (s ) ? ZSTR_H (s ) : zend_string_hash_func (s );
@@ -329,7 +327,9 @@ static zend_always_inline char *zend_cstr_append_char(const char *str, size_t le
329327}
330328
331329static zend_always_inline char * zend_cstr_concat (const char * s1 , size_t len1 , const char * s2 , size_t len2 ) {
332- char * res = (char * )safe_emalloc (len1 , 1 , len2 + 1 );
330+ size_t size = zend_safe_address_guarded (1 , len1 , len2 );
331+ size = zend_safe_address_guarded (1 , size , 1 );
332+ char * res = (char * )emalloc (size );
333333 if (len1 > 0 ) {
334334 memcpy (res , s1 , len1 );
335335 }
@@ -341,7 +341,10 @@ static zend_always_inline char *zend_cstr_concat(const char *s1, size_t len1, co
341341}
342342
343343static zend_always_inline char * zend_cstr_concat3 (const char * s1 , size_t len1 , const char * s2 , size_t len2 , const char * s3 , size_t len3 ) {
344- char * res = (char * )safe_emalloc (len1 , 1 , len2 + len3 + 1 );
344+ size_t size = zend_safe_address_guarded (1 , len1 , len2 );
345+ size = zend_safe_address_guarded (1 , size , len3 );
346+ size = zend_safe_address_guarded (1 , size , 1 );
347+ char * res = (char * )emalloc (size );
345348 if (len1 > 0 ) {
346349 memcpy (res , s1 , len1 );
347350 }
0 commit comments