com php-src: Fixed bug #74240 (deflate_add can allocate too much memory): NEWS ext/zlib/tests/bug74 240.phpt ext/zlib/zlib.c
[email protected] (Bob Weinand)
| Newsgroups | php.cvs |
|---|---|
| Message-ID | <[email protected]> |
Commit: 7fba8bda4c9e89c522e5d27a38489125e36b9904 Author: Matt Bonneau <[email protected]> Mon, 13 Mar 2017 00:11:30 -0400 Committer: Bob Weinand <[email protected]> Wed, 15 Mar 2017 00:08:32 +0100 Parents: 8be63ce0e2046e67e403f5ccd5aa06ecdd94e25c Branches: PHP-7.0 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=7fba8bda4c9e89c522e5d27a38489125e36b9904 Log: Fixed bug #74240 (deflate_add can allocate too much memory) Bugs: https://bugs.php.net/74240 Changed paths: M NEWS A ext/zlib/tests/bug74240.phpt M ext/zlib/zlib.c Diff: diff --git a/NEWS b/NEWS index 17048a4..071fcc8 100644 --- a/NEWS +++ b/NEWS @@ -23,9 +23,12 @@ PHP NEWS . Fixed bug #71003 (Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to PDO interface). (Thomas Orozco) -. Streams: +- Streams: . Fixed bug #74216 (Correctly fail on invalid IP address ports). (Sara) +- Zlib: + . Fixed bug #74240 (deflate_add can allocate too much memory). (Matt Bonneau) + 16 Mar 2017 PHP 7.0.17 - Core: diff --git a/ext/zlib/tests/bug74240.phpt b/ext/zlib/tests/bug74240.phpt new file mode 100644 index 0000000..f3d656a --- /dev/null +++ b/ext/zlib/tests/bug74240.phpt @@ -0,0 +1,30 @@ +--TEST-- +Bug #74240 (deflate_add can allocate too much memory) +--SKIPIF-- +<?php +if (!extension_loaded("zlib")) { + print "skip - ZLIB extension not loaded"; +} +?> +--FILE-- +<?php + +ini_set('memory_limit', '64M'); + +$deflator = deflate_init(ZLIB_ENCODING_RAW); + +$bytes = str_repeat("*", 65536); + +// this crashes after about 500 iterations if PHP is +// configured for 64M +for ($i = 0; $i < 1000; $i++) { + $output = deflate_add( + $deflator, + $bytes, + ZLIB_SYNC_FLUSH + ); +} +echo "Completed\n"; +?> +--EXPECT-- +Completed diff --git a/ext/zlib/zlib.c b/ext/zlib/zlib.c index 5c558ea..80607b6 100644 --- a/ext/zlib/zlib.c +++ b/ext/zlib/zlib.c @@ -1154,10 +1154,8 @@ PHP_FUNCTION(deflate_add) RETURN_EMPTY_STRING(); } - out_size = PHP_ZLIB_BUFFER_SIZE_GUESS(ctx->total_in + in_len); - out_size = (ctx->total_out >= out_size) ? 16 : (out_size - ctx->total_out); - out_size = (out_size < 16) ? 16 : out_size; - out_size += 64; + out_size = PHP_ZLIB_BUFFER_SIZE_GUESS(in_len); + out_size = (out_size < 64) ? 64 : out_size; out = zend_string_alloc(out_size, 0); ctx->next_in = (Bytef *) in_buf;