Fixed uint32_t overflow

3 files changed, 6 insertions, 6 deletions

diff --git a/ext/opcache/zend_accelerator_util_funcs.c b/ext/opcache/zend_accelerator_util_funcs.c
index f8554776a3..e04b1ec7db 100644
--- a/ext/opcache/zend_accelerator_util_funcs.c
+++ b/ext/opcache/zend_accelerator_util_funcs.c
@@ -317,7 +317,7 @@ static zend_ast *zend_ast_clone(zend_ast *ast TSRMLS_DC)
 	} else if (zend_ast_is_list(ast)) {
 		zend_ast_list *list = zend_ast_get_list(ast);
 		zend_ast_list *copy = emalloc(
-			sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1));
+			sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children);
 		copy->kind = list->kind;
 		copy->attr = list->attr;
 		copy->children = list->children;
@@ -331,7 +331,7 @@ static zend_ast *zend_ast_clone(zend_ast *ast TSRMLS_DC)
 		return (zend_ast *) copy;
 	} else {
 		uint32_t children = zend_ast_get_num_children(ast);
-		zend_ast *copy = emalloc(sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1));
+		zend_ast *copy = emalloc(sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children);
 		copy->kind = ast->kind;
 		copy->attr = ast->attr;
 		for (i = 0; i < children; i++) {
diff --git a/ext/opcache/zend_persist.c b/ext/opcache/zend_persist.c
index 5e290745bd..b49f28f4e3 100644
--- a/ext/opcache/zend_persist.c
+++ b/ext/opcache/zend_persist.c
@@ -154,7 +154,7 @@ static zend_ast *zend_persist_ast(zend_ast *ast TSRMLS_DC)
 	} else if (zend_ast_is_list(ast)) {
 		zend_ast_list *list = zend_ast_get_list(ast);
 		zend_ast_list *copy = zend_accel_memdup(ast,
-			sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1));
+			sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children);
 		for (i = 0; i < list->children; i++) {
 			if (copy->child[i]) {
 				copy->child[i] = zend_persist_ast(copy->child[i] TSRMLS_CC);
@@ -163,7 +163,7 @@ static zend_ast *zend_persist_ast(zend_ast *ast TSRMLS_DC)
 		node = (zend_ast *) copy;
 	} else {
 		uint32_t children = zend_ast_get_num_children(ast);
-		node = zend_accel_memdup(ast, sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1));
+		node = zend_accel_memdup(ast, sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children);
 		for (i = 0; i < children; i++) {
 			if (node->child[i]) {
 				node->child[i] = zend_persist_ast(node->child[i] TSRMLS_CC);
diff --git a/ext/opcache/zend_persist_calc.c b/ext/opcache/zend_persist_calc.c
index 989195119c..76d1b043b0 100644
--- a/ext/opcache/zend_persist_calc.c
+++ b/ext/opcache/zend_persist_calc.c
@@ -91,7 +91,7 @@ static uint zend_persist_ast_calc(zend_ast *ast TSRMLS_DC)
 		ADD_SIZE(zend_persist_zval_calc(zend_ast_get_zval(ast) TSRMLS_CC));
 	} else if (zend_ast_is_list(ast)) {
 		zend_ast_list *list = zend_ast_get_list(ast);
-		ADD_SIZE(sizeof(zend_ast_list) + sizeof(zend_ast *) * (list->children - 1));
+		ADD_SIZE(sizeof(zend_ast_list) - sizeof(zend_ast *) + sizeof(zend_ast *) * list->children);
 		for (i = 0; i < list->children; i++) {
 			if (list->child[i]) {
 				ADD_SIZE(zend_persist_ast_calc(list->child[i] TSRMLS_CC));
@@ -99,7 +99,7 @@ static uint zend_persist_ast_calc(zend_ast *ast TSRMLS_DC)
 		}
 	} else {
 		uint32_t children = zend_ast_get_num_children(ast);
-		ADD_SIZE(sizeof(zend_ast) + sizeof(zend_ast *) * (children - 1));
+		ADD_SIZE(sizeof(zend_ast) - sizeof(zend_ast *) + sizeof(zend_ast *) * children);
 		for (i = 0; i < children; i++) {
 			if (ast->child[i]) {
 				ADD_SIZE(zend_persist_ast_calc(ast->child[i] TSRMLS_CC));