diff --git a/ext/standard/array.c b/ext/standard/array.c index 3b17ca3f7942..0d4d0355c528 100644 --- a/ext/standard/array.c +++ b/ext/standard/array.c @@ -2734,13 +2734,13 @@ PHP_FUNCTION(array_fill_keys) #define RANGE_CHECK_LONG_INIT_ARRAY(start, end, _step) do { \ zend_ulong __calc_size = ((zend_ulong) start - end) / (_step); \ - if (__calc_size >= HT_MAX_SIZE - 1) { \ + if (__calc_size > HT_MAX_SIZE - 1) { \ uint64_t __excess = __calc_size - (HT_MAX_SIZE - 1); \ zend_value_error(\ "The supplied range exceeds the maximum array size by %" PRIu64 " elements: " \ "start=" ZEND_LONG_FMT ", end=" ZEND_LONG_FMT ", step=" ZEND_LONG_FMT ". " \ "Calculated size: %" PRIu64 ". Maximum size: %" PRIu64 ".", \ - __excess, end, start, (_step), (uint64_t)__calc_size, (uint64_t)HT_MAX_SIZE); \ + __excess, end, start, (_step), (uint64_t)__calc_size + 1, (uint64_t)HT_MAX_SIZE); \ RETURN_THROWS(); \ } \ size = (uint32_t)(__calc_size + 1); \ diff --git a/ext/standard/tests/array/gh22505.phpt b/ext/standard/tests/array/gh22505.phpt new file mode 100644 index 000000000000..dc34e969996c --- /dev/null +++ b/ext/standard/tests/array/gh22505.phpt @@ -0,0 +1,28 @@ +--TEST-- +GH-22505 : range() reports the correct calculated size when exceeding HT_MAX_SIZE +--INI-- +memory_limit=20G +--SKIPIF-- + +--FILE-- +getMessage(), "\n"; +} +try { + range(0, (1 << 30)); +} catch (ValueError $e) { + echo $e->getMessage(), "\n"; +} +echo 'Done'; +?> +--EXPECT-- +The supplied range exceeds the maximum array size by 1 elements: start=0, end=1073741824, step=1. Calculated size: 1073741825. Maximum size: 1073741824. +Done