From a4737c70684bda4fb8e3d47294c754f99971be2b Mon Sep 17 00:00:00 2001 From: Josh Date: Fri, 6 Nov 2026 11:12:23 -0500 Subject: [PATCH] Fix overflow in optimizer block-pass complexity guard Compute the variable count in uint64_t and compare it against the complexity limit divided by the basic-block count. This avoids overflow in both the variable-count addition and the original 32-bit multiplication. Preserve the existing 64M threshold and zero-block behavior. The division uses 32-bit operands on both 32-bit and 64-bit targets. The guard was introduced for [Bug #74250](https://bugs.php.net/bug.php?id=74250) to skip expensive block-pass optimization of large functions. Overflow could cause it to underestimate the work and run the pass instead. Assisted-by: Copilot:gpt-6.1-sol --- Zend/Optimizer/block_pass.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Zend/Optimizer/block_pass.c b/Zend/Optimizer/block_pass.c index 0601994479e6..606838185d89 100644 --- a/Zend/Optimizer/block_pass.c +++ b/Zend/Optimizer/block_pass.c @@ -1727,7 +1727,9 @@ void zend_optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx) checkpoint = zend_arena_checkpoint(ctx->arena); zend_build_cfg(&ctx->arena, op_array, 0, &cfg); - if (cfg.blocks_count * (op_array->last_var + op_array->T) > 64 * 1024 * 1024) { + uint64_t var_count = (uint64_t) op_array->last_var + op_array->T; + + if (cfg.blocks_count != 0 && var_count > (64u * 1024 * 1024) / cfg.blocks_count) { zend_arena_release(&ctx->arena, checkpoint); return; }