Commit c23eb1a9a53 for php
commit c23eb1a9a538309f07d6f364a389427cee265eba
Author: Gina Peter Banyard <girgias@php.net>
Date: Mon Nov 2 11:36:23 2026 +0000
tree: use correct argument order for allocation functions (#25079)
Note: these changes were done via a manual audit.
The primary motivation for using `sizeof(char)` rather than a literal `1` is to make the intention clearer, as a plain 1 can also mean "allocate 1 element of this alignment" and determining which meaning is not immediately obvious in many cases.
Some cases might have been missed, but hopefully it is all of them.
* tree: use correct argument ordering for safe_emalloc()
It is (nmemb, size, offset) not (size, nmemb, offset).
Use sizeof(char) instead of 1
For quoting allocations use (lenght*2, sizeof(char), offset) rather than various different combinations.
* tree: use correct argument ordering for safe_erealloc()
It is (ptr, nmemb, size, offset) not (ptr, size, nmemb, offset).
* tree: use correct argument ordering for ecalloc()
It is (nmemb, size) not (size, nmemb).
Use sizeof(char) instead of literal 1 in some cases
diff --git a/Zend/Optimizer/compact_vars.c b/Zend/Optimizer/compact_vars.c
index f6c39e9fe16..c1b48577811 100644
--- a/Zend/Optimizer/compact_vars.c
+++ b/Zend/Optimizer/compact_vars.c
@@ -96,7 +96,7 @@ void zend_optimizer_compact_vars(zend_op_array *op_array) {
/* Update CV name table */
if (num_cvs != op_array->last_var) {
if (num_cvs) {
- zend_string **names = safe_emalloc(sizeof(zend_string *), num_cvs, 0);
+ zend_string **names = safe_emalloc(num_cvs, sizeof(zend_string *), 0);
for (i = 0; i < op_array->last_var; i++) {
if (vars_map[i] != (uint32_t) -1) {
names[vars_map[i]] = op_array->vars[i];
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index f71a245526a..4ba5944db06 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -1243,7 +1243,7 @@ static uint32_t zend_add_try_element(uint32_t try_op) /* {{{ */
zend_try_catch_element *elem;
op_array->try_catch_array = safe_erealloc(
- op_array->try_catch_array, sizeof(zend_try_catch_element), op_array->last_try_catch, 0);
+ op_array->try_catch_array, op_array->last_try_catch, sizeof(zend_try_catch_element), 0);
elem = &op_array->try_catch_array[try_catch_offset];
elem->try_op = try_op;
@@ -5208,7 +5208,7 @@ static zend_result zend_compile_func_sprintf(znode *result, zend_ast_list *args)
znode *elements = NULL;
if (placeholder_count > 0) {
- elements = safe_emalloc(sizeof(*elements), placeholder_count, 0);
+ elements = safe_emalloc(placeholder_count, sizeof(*elements), 0);
}
/* Compile the value expressions first for error handling that is consistent
@@ -6816,7 +6816,7 @@ static void zend_compile_if(zend_ast *ast) /* {{{ */
uint32_t *jmp_opnums = NULL;
if (list->children > 1) {
- jmp_opnums = safe_emalloc(sizeof(uint32_t), list->children - 1, 0);
+ jmp_opnums = safe_emalloc(list->children - 1, sizeof(uint32_t), 0);
}
for (i = 0; i < list->children; ++i) {
@@ -6956,7 +6956,7 @@ static void zend_compile_switch(zend_ast *ast) /* {{{ */
opnum_switch = opline - CG(active_op_array)->opcodes;
}
- jmpnz_opnums = safe_emalloc(sizeof(uint32_t), cases->children, 0);
+ jmpnz_opnums = safe_emalloc(cases->children, sizeof(uint32_t), 0);
for (i = 0; i < cases->children; ++i) {
zend_ast *case_ast = cases->child[i];
zend_ast *cond_ast = case_ast->child[0];
@@ -7294,7 +7294,7 @@ static void zend_compile_match(znode *result, zend_ast *ast)
}
opnum_match = opline - CG(active_op_array)->opcodes;
} else {
- jmpnz_opnums = safe_emalloc(sizeof(uint32_t), num_conds, 0);
+ jmpnz_opnums = safe_emalloc(num_conds, sizeof(uint32_t), 0);
uint32_t cond_count = 0;
for (uint32_t i = 0; i < arms->children; ++i) {
zend_ast *arm_ast = arms->child[i];
@@ -7331,7 +7331,7 @@ static void zend_compile_match(znode *result, zend_ast *ast)
bool is_first_case = true;
uint32_t cond_count = 0;
- uint32_t *jmp_end_opnums = safe_emalloc(sizeof(uint32_t), arms->children, 0);
+ uint32_t *jmp_end_opnums = safe_emalloc(arms->children, sizeof(uint32_t), 0);
// The generated default arm is emitted first to avoid live range issues where the tmpvar
// for the arm result is freed even though it has not been initialized yet.
@@ -7441,7 +7441,7 @@ static void zend_compile_try(const zend_ast *ast) /* {{{ */
uint32_t i, j;
zend_op *opline;
uint32_t try_catch_offset;
- uint32_t *jmp_opnums = safe_emalloc(sizeof(uint32_t), catches->children, 0);
+ uint32_t *jmp_opnums = safe_emalloc(catches->children, sizeof(uint32_t), 0);
uint32_t orig_fast_call_var = CG(context).fast_call_var;
uint32_t orig_try_catch_offset = CG(context).try_catch_offset;
@@ -7493,7 +7493,7 @@ static void zend_compile_try(const zend_ast *ast) /* {{{ */
zend_string *var_name = var_ast ? zval_make_interned_string(zend_ast_get_zval(var_ast)) : NULL;
bool is_last_catch = (i + 1 == catches->children);
- uint32_t *jmp_multicatch = safe_emalloc(sizeof(uint32_t), classes->children - 1, 0);
+ uint32_t *jmp_multicatch = safe_emalloc(classes->children - 1, sizeof(uint32_t), 0);
uint32_t opnum_catch = (uint32_t)-1;
CG(zend_lineno) = catch_ast->lineno;
@@ -8440,7 +8440,7 @@ static void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast, uint32
if (return_type_ast || fallback_return_type) {
/* Use op_array->arg_info[-1] for return type */
- arg_infos = safe_emalloc(sizeof(zend_arg_info), list->children + 1, 0);
+ arg_infos = safe_emalloc(list->children + 1, sizeof(zend_arg_info), 0);
arg_infos->name = NULL;
if (return_type_ast) {
arg_infos->type = zend_compile_typename(return_type_ast);
@@ -8463,7 +8463,7 @@ static void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast, uint32
if (list->children == 0) {
return;
}
- arg_infos = safe_emalloc(sizeof(zend_arg_info), list->children, 0);
+ arg_infos = safe_emalloc(list->children, sizeof(zend_arg_info), 0);
}
/* Find last required parameter number for deprecation message. */
diff --git a/Zend/zend_ptr_stack.h b/Zend/zend_ptr_stack.h
index 6a6376f79da..e8179c02c93 100644
--- a/Zend/zend_ptr_stack.h
+++ b/Zend/zend_ptr_stack.h
@@ -49,7 +49,7 @@ END_EXTERN_C()
do { \
stack->max += PTR_STACK_BLOCK_SIZE; \
} while (stack->top+count > stack->max); \
- stack->elements = (void **) safe_perealloc(stack->elements, sizeof(void *), (stack->max), 0, stack->persistent); \
+ stack->elements = (void **) safe_perealloc(stack->elements, (stack->max), sizeof(void *), 0, stack->persistent); \
stack->top_element = stack->elements+stack->top; \
}
diff --git a/Zend/zend_smart_str.c b/Zend/zend_smart_str.c
index d5ab0c9a43d..d28f3e66d8f 100644
--- a/Zend/zend_smart_str.c
+++ b/Zend/zend_smart_str.c
@@ -73,7 +73,7 @@ static zend_always_inline bool i_smart_str_realloc(smart_str *str, size_t len, b
ZSTR_LEN(str->s) = 0;
} else {
size_t a = SMART_STR_NEW_LEN(len);
- zend_string *s = (zend_string *) safe_fperealloc(str->s, 1, a, _ZSTR_HEADER_SIZE + 1, /* persistent */ true, fallible);
+ zend_string *s = (zend_string *) safe_fperealloc(str->s, a, sizeof(char), _ZSTR_HEADER_SIZE + 1, /* persistent */ true, fallible);
if (ZEND_CONST_COND(fallible, true) && !s) {
return false;
}
diff --git a/Zend/zend_stream.c b/Zend/zend_stream.c
index 0627ae14593..cbbf7e63454 100644
--- a/Zend/zend_stream.c
+++ b/Zend/zend_stream.c
@@ -160,7 +160,7 @@ ZEND_API zend_result zend_stream_fixup(zend_file_handle *file_handle, char **buf
if (file_size) {
ssize_t read;
size_t size = 0;
- *buf = safe_emalloc(1, file_size, ZEND_MMAP_AHEAD);
+ *buf = safe_emalloc(file_size, sizeof(char), ZEND_MMAP_AHEAD);
while ((read = zend_stream_read(file_handle, *buf + size, file_size - size)) > 0) {
size += read;
}
diff --git a/Zend/zend_string.h b/Zend/zend_string.h
index d5674f3ff1c..5bd805aa8dd 100644
--- a/Zend/zend_string.h
+++ b/Zend/zend_string.h
@@ -299,7 +299,7 @@ static zend_always_inline zend_string *zend_string_frealloc(zend_string *s, size
if (!ZSTR_IS_INTERNED(s)) {
if (EXPECTED(GC_REFCOUNT(s) == 1)) {
- ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
+ ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) {
return NULL;
}
@@ -331,7 +331,7 @@ static zend_always_inline zend_string *zend_string_fextend(zend_string *s, size_
ZEND_ASSERT(len >= ZSTR_LEN(s));
if (!ZSTR_IS_INTERNED(s)) {
if (EXPECTED(GC_REFCOUNT(s) == 1)) {
- ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
+ ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) {
return NULL;
}
@@ -363,7 +363,7 @@ static zend_always_inline zend_string *zend_string_ftruncate(zend_string *s, siz
ZEND_ASSERT(len <= ZSTR_LEN(s));
if (!ZSTR_IS_INTERNED(s)) {
if (EXPECTED(GC_REFCOUNT(s) == 1)) {
- ret = (zend_string *)safe_fperealloc(s, 1, len, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
+ ret = (zend_string *)safe_fperealloc(s, len, sizeof(char), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(0)), persistent, fallible);
if (ZEND_CONST_COND(fallible, true) && UNEXPECTED(!ret)) {
return NULL;
}
@@ -420,7 +420,7 @@ static zend_always_inline zend_string *zend_string_safe_realloc(zend_string *s,
}
static zend_always_inline char *zend_cstr_append_char(const char *str, size_t len, char c) {
- char *res = (char *)safe_emalloc(len, 1, 2);
+ char *res = (char *)safe_emalloc(len, sizeof(char), 2);
if (len > 0) {
memcpy(res, str, len);
}
diff --git a/ext/hash/hash.c b/ext/hash/hash.c
index a950d824700..a289ab5e8f5 100644
--- a/ext/hash/hash.c
+++ b/ext/hash/hash.c
@@ -1039,7 +1039,7 @@ PHP_FUNCTION(hash_pbkdf2)
result = safe_emalloc(loops, ops->digest_size, 0);
- computed_salt = safe_emalloc(salt_len, 1, 4);
+ computed_salt = safe_emalloc(salt_len, sizeof(unsigned char), 4);
memcpy(computed_salt, (unsigned char *) salt, salt_len);
for (i = 1; i <= loops; i++) {
diff --git a/ext/intl/converter/converter.cpp b/ext/intl/converter/converter.cpp
index 55c35399fe0..ded841b981f 100644
--- a/ext/intl/converter/converter.cpp
+++ b/ext/intl/converter/converter.cpp
@@ -609,7 +609,7 @@ static zend_string* php_converter_do_convert(UConverter *dest_cnv,
THROW_UFAILURE(objval, error);
return nullptr;
}
- temp = reinterpret_cast<UChar *>(safe_femalloc(sizeof(UChar), temp_len, sizeof(UChar), /* fallible */ true));
+ temp = reinterpret_cast<UChar *>(safe_femalloc(temp_len, sizeof(UChar), sizeof(UChar), /* fallible */ true));
if (!temp) {
return NULL;
}
diff --git a/ext/intl/locale/locale_methods.cpp b/ext/intl/locale/locale_methods.cpp
index 5fd89c62f15..121265b4862 100644
--- a/ext/intl/locale/locale_methods.cpp
+++ b/ext/intl/locale/locale_methods.cpp
@@ -1397,7 +1397,7 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches)
}
/* Convert to lower case for case-insensitive comparison */
- cur_lang_tag = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc( 1, can_lang_tag->len + 1)));
+ cur_lang_tag = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(can_lang_tag->len + 1, sizeof(char))));
char *p_cur_lang_tag = cur_lang_tag.get();
/* Convert to lower case for case-insensitive comparison */
@@ -1407,7 +1407,7 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches)
RETURN_FALSE;
}
- cur_loc_range = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc( 1, can_loc_range->len + 1)));
+ cur_loc_range = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(can_loc_range->len + 1, sizeof(char))));
char *p_cur_loc_range = cur_loc_range.get();
result = strToMatch( can_loc_range->val , p_cur_loc_range );
if( result == 0) {
@@ -1437,14 +1437,14 @@ PHP_INTL_FUNCTION_WITH_ERROR_RESET(locale_filter_matches)
} /* end of if isCanonical */
else{
/* Convert to lower case for case-insensitive comparison */
- cur_lang_tag = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(1, lang_tag_len + 1)));
+ cur_lang_tag = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(lang_tag_len + 1, sizeof(char))));
char *p_cur_lang_tag = cur_lang_tag.get();
result = strToMatch( lang_tag , p_cur_lang_tag);
if( result == 0) {
RETURN_FALSE;
}
- cur_loc_range = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(1, loc_range_len + 1)));
+ cur_loc_range = std::unique_ptr<char, char_deleter>(reinterpret_cast<char *>(ecalloc(loc_range_len + 1, sizeof(char))));
char *p_cur_loc_range = cur_loc_range.get();
result = strToMatch( loc_range , p_cur_loc_range );
if( result == 0) {
@@ -1561,7 +1561,7 @@ static zend_string* lookup_loc_range(const char* loc_range, HashTable* hash_arr,
}
}
- cur_loc_range = reinterpret_cast<char *>(ecalloc(1, strlen(loc_range)+1));
+ cur_loc_range = reinterpret_cast<char *>(ecalloc(strlen(loc_range)+1, sizeof(char)));
/* convert to lower and replace hyphens */
result = strToMatch(loc_range, cur_loc_range);
if(can_loc_range) {
diff --git a/ext/intl/msgformat/msgformat_data.cpp b/ext/intl/msgformat/msgformat_data.cpp
index 0a059a9ea48..c2db3ec426e 100644
--- a/ext/intl/msgformat/msgformat_data.cpp
+++ b/ext/intl/msgformat/msgformat_data.cpp
@@ -68,7 +68,7 @@ void msgformat_data_free(msgformat_data* mf_data)
int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec)
{
if(*spattern && *spattern_len && u_strchr(*spattern, (UChar)'\'')) {
- UChar *npattern = safe_emalloc(sizeof(UChar)*2, *spattern_len, sizeof(UChar));
+ UChar *npattern = safe_emalloc(*spattern_len, sizeof(UChar)*2, sizeof(UChar));
uint32_t npattern_len;
npattern_len = umsg_autoQuoteApostrophe(*spattern, *spattern_len, npattern, 2*(*spattern_len)+1, ec);
efree(*spattern);
diff --git a/ext/intl/uchar/uchar.cpp b/ext/intl/uchar/uchar.cpp
index 3b3edfca49a..9479287b5e0 100644
--- a/ext/intl/uchar/uchar.cpp
+++ b/ext/intl/uchar/uchar.cpp
@@ -544,7 +544,7 @@ IC_METHOD(getFC_NFKC_Closure) {
if (closure_len == 0) {
RETURN_EMPTY_STRING();
}
- closure = reinterpret_cast<UChar *>(safe_emalloc(sizeof(UChar), closure_len + 1, 0));
+ closure = reinterpret_cast<UChar *>(safe_emalloc(closure_len + 1, sizeof(UChar), 0));
error = U_ZERO_ERROR;
closure_len = u_getFC_NFKC_Closure(cp, closure, closure_len, &error);
if (U_FAILURE(error)) {
diff --git a/ext/odbc/php_odbc.c b/ext/odbc/php_odbc.c
index e10d60d64cb..044e90df54c 100644
--- a/ext/odbc/php_odbc.c
+++ b/ext/odbc/php_odbc.c
@@ -684,7 +684,7 @@ void odbc_bindcols(odbc_result *result)
SQLLEN displaysize;
SQLUSMALLINT colfieldid;
- result->values = (odbc_result_value *) safe_emalloc(sizeof(odbc_result_value), result->numcols, 0);
+ result->values = (odbc_result_value *) safe_emalloc(result->numcols, sizeof(odbc_result_value), 0);
result->longreadlen = ODBCG(defaultlrl);
result->binmode = ODBCG(defaultbinmode);
@@ -954,7 +954,7 @@ PHP_FUNCTION(odbc_prepare)
result->fetched = 0;
odbc_insert_new_result(conn, return_value);
- result->param_info = (odbc_param_info *) safe_emalloc(sizeof(odbc_param_info), result->numparams, 0);
+ result->param_info = (odbc_param_info *) safe_emalloc(result->numparams, sizeof(odbc_param_info), 0);
for (i=0;i<result->numparams;i++) {
rc = SQLDescribeParam(result->stmt, (SQLUSMALLINT)(i+1), &result->param_info[i].sqltype, &result->param_info[i].precision,
&result->param_info[i].scale, &result->param_info[i].nullable);
@@ -1017,7 +1017,7 @@ PHP_FUNCTION(odbc_execute)
RETURN_FALSE;
}
- params = (odbc_params_t *)safe_emalloc(sizeof(odbc_params_t), result->numparams, 0);
+ params = (odbc_params_t *)safe_emalloc(result->numparams, sizeof(odbc_params_t), 0);
for(i = 0; i < result->numparams; i++) {
params[i].fp = -1;
params[i].zstr = NULL;
diff --git a/ext/openssl/openssl_backend_common.c b/ext/openssl/openssl_backend_common.c
index 995d836deea..62a8350f75c 100644
--- a/ext/openssl/openssl_backend_common.c
+++ b/ext/openssl/openssl_backend_common.c
@@ -1727,7 +1727,7 @@ zend_result php_openssl_validate_iv(const char **piv, size_t *piv_len, size_t iv
return SUCCESS;
}
- iv_new = ecalloc(1, iv_required_len + 1);
+ iv_new = ecalloc(iv_required_len + 1, sizeof(char));
if (*piv_len == 0) {
/* BC behavior */
diff --git a/ext/pdo/pdo_dbh.c b/ext/pdo/pdo_dbh.c
index 35c0767d99a..d5bb95a7630 100644
--- a/ext/pdo/pdo_dbh.c
+++ b/ext/pdo/pdo_dbh.c
@@ -1399,7 +1399,7 @@ bool pdo_hash_methods(pdo_dbh_object_t *dbh_obj, int kind)
func.function_name = zend_string_init(funcs->fname, strlen(funcs->fname), dbh->is_persistent);
func.scope = pdo_dbh_ce;
func.prototype = NULL;
- ZEND_MAP_PTR(func.run_time_cache) = rt_cache_size ? pecalloc(rt_cache_size, 1, dbh->is_persistent) : NULL;
+ ZEND_MAP_PTR(func.run_time_cache) = rt_cache_size ? pecalloc(1, rt_cache_size, dbh->is_persistent) : NULL;
func.T = ZEND_OBSERVER_ENABLED;
if (funcs->flags) {
func.fn_flags = funcs->flags | ZEND_ACC_NEVER_CACHE;
diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c
index 7f39a2d5702..ce4253c82c9 100644
--- a/ext/pdo/pdo_stmt.c
+++ b/ext/pdo/pdo_stmt.c
@@ -825,7 +825,7 @@ static bool do_fetch(pdo_stmt_t *stmt, zval *return_value, enum pdo_fetch_type h
}
/* There will be at most stmt->column_count parameters.
* However, if we fetch a group key we will have over allocated. */
- fetch_function_params = safe_emalloc(sizeof(zval), stmt->column_count, 0);
+ fetch_function_params = safe_emalloc(stmt->column_count, sizeof(zval), 0);
break;
default: ZEND_UNREACHABLE();
}
diff --git a/ext/pdo_firebird/firebird_statement.c b/ext/pdo_firebird/firebird_statement.c
index f1e60e25b41..1d3edd20d9f 100644
--- a/ext/pdo_firebird/firebird_statement.c
+++ b/ext/pdo_firebird/firebird_statement.c
@@ -195,14 +195,13 @@ static int pdo_firebird_stmt_execute(pdo_stmt_t *stmt) /* {{{ */
/* allocate storage for the output data */
if (S->out_sqlda.sqld) {
- unsigned int i;
- for (i = 0; i < S->out_sqlda.sqld; i++) {
+ for (ISC_SHORT i = 0; i < S->out_sqlda.sqld; i++) {
XSQLVAR *var = &S->out_sqlda.sqlvar[i];
if (var->sqlind) {
efree(var->sqlind);
}
- var->sqlind = (void*)ecalloc(1, var->sqllen + 2 * sizeof(short));
- var->sqldata = &((char*)var->sqlind)[sizeof(short)];
+ var->sqlind = (void*)ecalloc(var->sqllen + 2, sizeof(ISC_SHORT));
+ var->sqldata = &((char*)var->sqlind)[sizeof(ISC_SHORT)];
}
}
diff --git a/ext/pdo_pgsql/pgsql_driver.c b/ext/pdo_pgsql/pgsql_driver.c
index bdb8a067e61..ddef73f024f 100644
--- a/ext/pdo_pgsql/pgsql_driver.c
+++ b/ext/pdo_pgsql/pgsql_driver.c
@@ -451,7 +451,7 @@ static zend_string* pgsql_handle_quoter(pdo_dbh_t *dbh, const zend_string *unquo
PQfreemem(escaped);
break;
default:
- quoted = safe_emalloc(2, ZSTR_LEN(unquoted), 3);
+ quoted = safe_emalloc(ZSTR_LEN(unquoted) * 2, sizeof(char), 3);
quoted[0] = '\'';
quotedlen = PQescapeStringConn(H->server, quoted + 1, ZSTR_VAL(unquoted), ZSTR_LEN(unquoted), &err);
if (err) {
diff --git a/ext/pdo_sqlite/sqlite_driver.c b/ext/pdo_sqlite/sqlite_driver.c
index 9c0a6be0bc0..692bb8fd6c8 100644
--- a/ext/pdo_sqlite/sqlite_driver.c
+++ b/ext/pdo_sqlite/sqlite_driver.c
@@ -237,7 +237,7 @@ static zend_string* sqlite_handle_quoter(pdo_dbh_t *dbh, const zend_string *unqu
return NULL;
}
- quoted = safe_emalloc(2, ZSTR_LEN(unquoted), 3);
+ quoted = safe_emalloc(ZSTR_LEN(unquoted) * 2, sizeof(char), 3);
/* TODO use %Q format? */
sqlite3_snprintf(2*ZSTR_LEN(unquoted) + 3, quoted, "'%q'", ZSTR_VAL(unquoted));
zend_string *quoted_str = zend_string_init(quoted, strlen(quoted), 0);
diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
index 3da14305186..2eb2d6b306e 100644
--- a/ext/pgsql/pgsql.c
+++ b/ext/pgsql/pgsql.c
@@ -1217,7 +1217,7 @@ static char **php_pgsql_make_arguments(const HashTable *param_arr, int *num_para
{
/* This conversion is safe because of the limit of number of elements in a table. */
*num_params = (int) zend_hash_num_elements(param_arr);
- char **params = safe_emalloc(sizeof(char *), *num_params, 0);
+ char **params = safe_emalloc(*num_params, sizeof(char *), 0);
uint32_t i = 0;
ZEND_HASH_FOREACH_VAL(param_arr, zval *tmp) {
@@ -4570,7 +4570,7 @@ PHP_PGSQL_API zend_result php_pgsql_meta_data(PGconn *pg_link, const zend_string
"WHERE a.attnum > 0 AND c.relname = '");
}
len = strlen(tmp_name2);
- escaped = (char *)safe_emalloc(len, 2, 1);
+ escaped = (char *)safe_emalloc(len * 2, sizeof(char), 1);
new_len = PQescapeStringConn(pg_link, escaped, tmp_name2, len, &err);
if (err) {
php_error_docref(NULL, E_WARNING, "Escaping table name '%pS' failed", table_name);
@@ -4586,7 +4586,7 @@ PHP_PGSQL_API zend_result php_pgsql_meta_data(PGconn *pg_link, const zend_string
smart_str_appends(&querystr, "' AND n.nspname = '");
len = strlen(tmp_name);
- escaped = (char *)safe_emalloc(len, 2, 1);
+ escaped = (char *)safe_emalloc(len * 2, sizeof(char), 1);
new_len = PQescapeStringConn(pg_link, escaped, tmp_name, len, &err);
if (err) {
php_error_docref(NULL, E_WARNING, "Escaping table namespace '%pS' failed", table_name);
@@ -5640,7 +5640,7 @@ PHP_PGSQL_API zend_result php_pgsql_insert(PGconn *pg_link, const zend_string *t
case IS_STRING:
if (opt & PGSQL_DML_ESCAPE) {
int error;
- char *tmp = safe_emalloc(Z_STRLEN_P(val), 2, 1);
+ char *tmp = safe_emalloc(Z_STRLEN_P(val) * 2, sizeof(char), 1);
size_t new_len = PQescapeStringConn(pg_link, tmp, Z_STRVAL_P(val), Z_STRLEN_P(val), &error);
if (error) {
php_error_docref(NULL, E_NOTICE, "Failed to escape field '%pS' value", fld);
@@ -5824,7 +5824,7 @@ static inline int build_assignment_string(PGconn *pg_link, smart_str *querystr,
case IS_STRING:
if (opt & PGSQL_DML_ESCAPE) {
int error;
- char *tmp = (char *)safe_emalloc(Z_STRLEN_P(val), 2, 1);
+ char *tmp = (char *)safe_emalloc(Z_STRLEN_P(val) * 2, sizeof(char), 1);
size_t new_len = PQescapeStringConn(pg_link, tmp, Z_STRVAL_P(val), Z_STRLEN_P(val), &error);
if (error) {
php_error_docref(NULL, E_NOTICE, "Failed to escape field '%pS' value", fld);
diff --git a/ext/phar/tar.c b/ext/phar/tar.c
index c48061740e2..e2d6165b989 100644
--- a/ext/phar/tar.c
+++ b/ext/phar/tar.c
@@ -212,7 +212,7 @@ static zend_result phar_tar_process_metadata(phar_entry_info *entry, php_stream
size_t save = php_stream_tell(fp), read;
phar_entry_info *mentry;
- metadata = (char *) safe_emalloc(1, entry->uncompressed_filesize, 1);
+ metadata = (char *) safe_emalloc(entry->uncompressed_filesize, sizeof(char), 1);
read = php_stream_read(fp, metadata, entry->uncompressed_filesize);
if (read != entry->uncompressed_filesize) {
@@ -1318,7 +1318,7 @@ ZEND_ATTRIBUTE_NONNULL_ARGS(1, 4) int phar_tar_flush(phar_archive_data *phar, ze
} /* signature */
/* add final zero blocks */
- buf = (char *) ecalloc(1024, 1);
+ buf = (char *) ecalloc(1024, sizeof(char));
php_stream_write(newfile, buf, 1024);
efree(buf);
diff --git a/ext/phar/util.c b/ext/phar/util.c
index 539b927657b..2d636e9b84f 100644
--- a/ext/phar/util.c
+++ b/ext/phar/util.c
@@ -1352,7 +1352,7 @@ static size_t phar_hex_str(const char *digest, size_t digest_len, char **signatu
size_t pos = 0;
size_t len = 0;
- *signature = (char*)safe_pemalloc(digest_len, 2, 1, PHAR_G(persist));
+ *signature = (char*)safe_pemalloc(digest_len * 2, sizeof(char), 1, PHAR_G(persist));
for (; len < digest_len; ++len) {
(*signature)[pos++] = hexChars[((const unsigned char *)digest)[len] >> 4];
diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c
index 79c58987b8c..1c0d8ed2f80 100644
--- a/ext/snmp/snmp.c
+++ b/ext/snmp/snmp.c
@@ -714,7 +714,7 @@ static bool php_snmp_parse_oid(
zend_argument_value_error(oid_arg_num, "must not be empty when passed as an array");
return false;
}
- objid_query->vars = (snmpobjarg *)safe_emalloc(sizeof(snmpobjarg), zend_hash_num_elements(oid_ht), 0);
+ objid_query->vars = (snmpobjarg *)safe_emalloc(zend_hash_num_elements(oid_ht), sizeof(snmpobjarg), 0);
memset(objid_query->vars, 0, sizeof(snmpobjarg) * zend_hash_num_elements(oid_ht));
objid_query->array_output = (st & SNMP_CMD_SET) == 0;
ZEND_HASH_FOREACH_VAL(oid_ht, tmp_oid) {
diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
index bc70c06fac3..be37c4e6032 100644
--- a/ext/soap/php_encoding.c
+++ b/ext/soap/php_encoding.c
@@ -984,7 +984,7 @@ static xmlNodePtr to_xml_hexbin(encodeTypePtr type, zval *data, int style, xmlNo
ZVAL_STR(&tmp, get_serialization_string_from_zval(data));
data = &tmp;
}
- str = (unsigned char *) safe_emalloc(Z_STRLEN_P(data), 2, 1);
+ str = (unsigned char *) safe_emalloc(Z_STRLEN_P(data) * 2, sizeof(unsigned char), 1);
for (i = j = 0; i < Z_STRLEN_P(data); i++) {
str[j++] = hexconvtab[((unsigned char)Z_STRVAL_P(data)[i]) >> 4];
@@ -2076,7 +2076,7 @@ static int* get_position_12(int dimension, const char* str)
int *pos;
int i = -1, flag = 0;
- pos = safe_emalloc(sizeof(int), dimension, 0);
+ pos = safe_emalloc(dimension, sizeof(int), 0);
memset(pos,0,sizeof(int)*dimension);
while (*str != '\0' && (*str < '0' || *str > '9') && (*str != '*')) {
str++;
@@ -2133,7 +2133,7 @@ static int* get_position(int dimension, const char* str)
{
int *pos;
- pos = safe_emalloc(sizeof(int), dimension, 0);
+ pos = safe_emalloc(dimension, sizeof(int), 0);
get_position_ex(dimension, str, &pos);
return pos;
}
@@ -2355,7 +2355,7 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
smart_str_appends(&array_type, value);
}
- dims = safe_emalloc(sizeof(int), dimension, 0);
+ dims = safe_emalloc(dimension, sizeof(int), 0);
dims[0] = i;
el = data;
for (i = 1; i < dimension; i++) {
@@ -2450,13 +2450,13 @@ static xmlNodePtr to_xml_array(encodeTypePtr type, zval *data, int style, xmlNod
smart_str_append_long(&array_size, i);
- dims = safe_emalloc(sizeof(int), dimension, 0);
+ dims = safe_emalloc(dimension, sizeof(int), 0);
dims[0] = i;
} else {
enc = get_array_type(xmlParam, data, &array_type);
smart_str_append_long(&array_size, i);
- dims = safe_emalloc(sizeof(int), dimension, 0);
+ dims = safe_emalloc(dimension, sizeof(int), 0);
dims[0] = i;
}
@@ -2660,7 +2660,7 @@ static zval *to_zval_array(zval *ret, encodeTypePtr type, xmlNodePtr data)
dims = emalloc(sizeof(int));
*dims = 0;
}
- pos = safe_emalloc(sizeof(int), dimension, 0);
+ pos = safe_emalloc(dimension, sizeof(int), 0);
memset(pos,0,sizeof(int)*dimension);
if (data &&
(attr = get_soap_enc_attribute(data->properties,"offset")) &&
diff --git a/ext/soap/soap.c b/ext/soap/soap.c
index 8d5fc9a694d..df39d5f429d 100644
--- a/ext/soap/soap.c
+++ b/ext/soap/soap.c
@@ -2763,7 +2763,7 @@ static void soap_client_call_common(
zval *param;
int i = 0;
- real_args = safe_emalloc(sizeof(zval), arg_count, 0);
+ real_args = safe_emalloc(arg_count, sizeof(zval), 0);
ZEND_HASH_FOREACH_VAL(args, param) {
/*zval_add_ref(param);*/
ZVAL_DEREF(param);
diff --git a/ext/sockets/multicast.c b/ext/sockets/multicast.c
index 9ff7eb0b136..0afacd2ecce 100644
--- a/ext/sockets/multicast.c
+++ b/ext/sockets/multicast.c
@@ -777,7 +777,7 @@ zend_result php_add4_to_if_index(struct in_addr *addr, php_socket *php_sock, uns
for(;;) {
size += 5 * sizeof(struct ifreq);
- buf = ecalloc(size, 1);
+ buf = ecalloc(size, sizeof(char));
if_conf.ifc_len = size;
if_conf.ifc_buf = buf;
diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c
index 74298a04c94..d21ef76c47a 100644
--- a/ext/spl/spl_heap.c
+++ b/ext/spl/spl_heap.c
@@ -251,7 +251,7 @@ static spl_ptr_heap *spl_ptr_heap_init(spl_ptr_heap_cmp_func cmp, spl_ptr_heap_c
heap->dtor = dtor;
heap->ctor = ctor;
heap->cmp = cmp;
- heap->elements = ecalloc(PTR_HEAP_BLOCK_SIZE, elem_size);
+ heap->elements = ecalloc(elem_size, PTR_HEAP_BLOCK_SIZE);
heap->max_size = PTR_HEAP_BLOCK_SIZE;
heap->count = 0;
heap->flags = 0;
diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 0dbb0ec7303..db302ab724a 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -923,7 +923,7 @@ static int parse_opts(char * opts, opt_struct ** result)
}
}
- paras = safe_emalloc(sizeof(opt_struct), count, 0);
+ paras = safe_emalloc(count, sizeof(opt_struct), 0);
memset(paras, 0, sizeof(opt_struct) * count);
*result = paras;
while ( (*opts >= 48 && *opts <= 57) || /* 0 - 9 */
@@ -990,7 +990,7 @@ PHP_FUNCTION(getopt)
/* Attempt to allocate enough memory to hold all of the arguments
* and a trailing NULL */
- argv = (char **) safe_emalloc(sizeof(char *), (argc + 1), 0);
+ argv = (char **) safe_emalloc((argc + 1), sizeof(char *), 0);
/* Iterate over the hash to construct the argv array. */
ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(args), entry) {
@@ -1020,7 +1020,7 @@ PHP_FUNCTION(getopt)
/* the first <len> slots are filled by the one short ops
* we now extend our array and jump to the new added structs */
- opts = (opt_struct *) safe_erealloc(opts, sizeof(opt_struct), (len + count + 1), 0);
+ opts = (opt_struct *) safe_erealloc(opts, (len + count + 1), sizeof(opt_struct), 0);
orig_opts = opts;
opts += len;
diff --git a/ext/standard/browscap.c b/ext/standard/browscap.c
index 0defff2fb14..b11221fd1a5 100644
--- a/ext/standard/browscap.c
+++ b/ext/standard/browscap.c
@@ -255,7 +255,7 @@ static void browscap_add_kv(
browser_data *bdata, zend_string *key, zend_string *value, bool persistent) {
if (bdata->kv_used == bdata->kv_size) {
bdata->kv_size *= 2;
- bdata->kv = safe_perealloc(bdata->kv, sizeof(browscap_kv), bdata->kv_size, 0, persistent);
+ bdata->kv = safe_perealloc(bdata->kv, bdata->kv_size, sizeof(browscap_kv), 0, persistent);
}
bdata->kv[bdata->kv_used].key = key;
diff --git a/ext/standard/image.c b/ext/standard/image.c
index 66fc4156a9b..ff07f5a3874 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -174,7 +174,7 @@ static struct php_gfxinfo *php_handle_swc(php_stream * stream)
return NULL;
}
- b = ecalloc(1, len + 1);
+ b = ecalloc(len + 1, sizeof(unsigned char));
if (uncompress(b, &len, a, sizeof(a)) != Z_OK) {
/* failed to decompress the file, will try reading the rest of the file */
diff --git a/ext/standard/proc_open.c b/ext/standard/proc_open.c
index 99c11dc7c62..764d5868679 100644
--- a/ext/standard/proc_open.c
+++ b/ext/standard/proc_open.c
@@ -175,7 +175,7 @@ ZEND_ATTRIBUTE_NONNULL static php_process_env php_array_to_envp(const HashTable
#ifndef PHP_WIN32
env.envarray = (char **) ecalloc(1, sizeof(char *));
#endif
- env.envp = (char *) ecalloc(4, 1);
+ env.envp = (char *) ecalloc(4, sizeof(char));
return env;
}
@@ -204,7 +204,7 @@ ZEND_ATTRIBUTE_NONNULL static php_process_env php_array_to_envp(const HashTable
#ifndef PHP_WIN32
ep = env.envarray = (char **) ecalloc(cnt + 1, sizeof(char *));
#endif
- p = env.envp = (char *) ecalloc(sizeenv + 4, 1);
+ p = env.envp = (char *) ecalloc(sizeenv + 4, sizeof(char));
ZEND_HASH_FOREACH_STR_KEY_PTR(env_hash, key, str) {
#ifndef PHP_WIN32
@@ -795,7 +795,7 @@ static zend_string* get_command_from_array(const HashTable *array, char ***argv,
zend_string *command = NULL;
uint32_t i = 0;
- *argv = safe_emalloc(sizeof(char *), num_elems + 1, 0);
+ *argv = safe_emalloc(num_elems + 1, sizeof(char *), 0);
ZEND_HASH_FOREACH_VAL(array, arg_zv) {
zend_string *arg_str = get_valid_arg_string(arg_zv, i + 1);
diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c
index 5aeb585fea2..4a559547c02 100644
--- a/ext/standard/scanf.c
+++ b/ext/standard/scanf.c
@@ -161,9 +161,9 @@ static char * BuildCharSet(CharSet *cset, char *format)
ch = end++;
}
- cset->chars = (char *) safe_emalloc(sizeof(char), (end - format - 1), 0);
+ cset->chars = (char *) safe_emalloc((end - format - 1), sizeof(char), 0);
if (nranges > 0) {
- cset->ranges = (struct Range *) safe_emalloc(sizeof(struct Range), nranges, 0);
+ cset->ranges = (struct Range *) safe_emalloc(nranges, sizeof(struct Range), 0);
} else {
cset->ranges = NULL;
}
@@ -317,7 +317,7 @@ PHPAPI int ValidateFormat(char *format, int numVars, int *totalSubs)
* a variable is multiply assigned or left unassigned.
*/
if (numVars > nspace) {
- nassign = (int*)safe_emalloc(sizeof(int), numVars, 0);
+ nassign = (int*)safe_emalloc(numVars, sizeof(int), 0);
nspace = numVars;
}
for (i = 0; i < nspace; i++) {
diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c
index b699c12ed9b..bc4ac90e2c1 100644
--- a/ext/standard/user_filters.c
+++ b/ext/standard/user_filters.c
@@ -351,7 +351,7 @@ static php_stream_filter *user_filter_factory_create(const char *filtername,
TODO: Allow failed userfilter creations to continue
scanning through the list */
if ((period = strrchr(filtername, '.'))) {
- char *wildcard = safe_emalloc(len, 1, 3);
+ char *wildcard = safe_emalloc(len, sizeof(char), 3);
/* Search for wildcard matches instead */
memcpy(wildcard, filtername, len + 1); /* copy \0 */
diff --git a/ext/standard/versioning.c b/ext/standard/versioning.c
index dc7ca71af46..33d89167114 100644
--- a/ext/standard/versioning.c
+++ b/ext/standard/versioning.c
@@ -26,7 +26,7 @@ PHPAPI char *
php_canonicalize_version(const char *version)
{
size_t len = strlen(version);
- char *buf = safe_emalloc(len, 2, 1), *q, lp, lq;
+ char *buf = safe_emalloc(len * 2, sizeof(char), 1), *q, lp, lq;
const char *p;
if (len == 0) {
diff --git a/main/rfc1867.c b/main/rfc1867.c
index ea9446bd0f7..334d0dd877e 100644
--- a/main/rfc1867.c
+++ b/main/rfc1867.c
@@ -265,7 +265,7 @@ static multipart_buffer *multipart_buffer_new(char *boundary, int boundary_len)
int minsize = boundary_len + 6;
if (minsize < FILLUNIT) minsize = FILLUNIT;
- self->buffer = (char *) ecalloc(1, minsize + 1);
+ self->buffer = (char *) ecalloc(minsize + 1, sizeof(char));
self->bufsize = minsize;
spprintf(&self->boundary, 0, "--%s", boundary);
diff --git a/main/streams/filter.c b/main/streams/filter.c
index fdc5dfc00ad..0cfb454ca92 100644
--- a/main/streams/filter.c
+++ b/main/streams/filter.c
@@ -230,7 +230,7 @@ PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, zval
/* try a wildcard */
char *wildname;
- wildname = safe_emalloc(1, n, 3);
+ wildname = safe_emalloc(n, sizeof(char), 3);
memcpy(wildname, filtername, n+1);
char *new_period = wildname + (period - filtername);
while (new_period && !filter) {