Prevent potential buffer overflow for large value of php_cli_server_workers_max

[yiyuaner]

Fixes issue 8989.

[cmb69]

Thank you for the PR! I don't like the silent fall back to 1 worker, though. Can't we use safe_emalloc() instead of calloc() (fails hard if unsuccessful), and clear the memory afterwards?

[devnexen]

I agree here in the sense it s not correct to hide it, you can possibly catch out of range from the value before allocation (like nginx does to catch silly values for its worker processes) or as @cmb69 said, either way need clarity from user's perspective.

[yiyuaner]

If I understand it correctly, replacing calloc with safe_emalloc can resolve this. When integer overflow happens, an error message is printed and the program aborts.

[devnexen]

Two keys here:
1/ > and clear the memory afterwards.
since you re moving from calloc.
2/ You might need a change for free(php_cli_server_workers).

[yiyuaner]

Ok. I have replaced it with efree.

[devnexen]

Indeed. Don t forget the first point :)

[yiyuaner]

ecalloc is a safe version of calloc that checks for multiply overflow. I think it can be used here.

[devnexen]

Alright, @cmb69 will have a last look in case I missed something. Nice work.

[cmb69]

ecalloc() and friends allocate memory which is freed at the end of each request. That would cause issues here. Instead you'd need pecalloc() with the third argument being 1 (and use pefree() instead of efree() above). Note that the Zend memory allocation functions are infallible, i.e. they never return NULL (but instead terminate the process), so the following NULL check is superfluous.

[cmb69]

Thank you!