#40189 [Fbk->Asn]: endless loop in zlib.inflate stream filter
ID: 40189
Updated by: cellog@php.net
Reported By: cellog@php.net
-Status: Feedback
+Status: Assigned
Bug Type: Zlib Related
Operating System: kubuntu linux
PHP Version: 5CVS-2007-01-22 (CVS)
Assigned To: pollita
New Comment:
cvs update -f "Jan 22 02:07:44 2007 UTC"
I committed a workaround for the failure, completely
forgetting you needed the file for this bug, sorry. This
is the patch that needs to be reversed:
http://cvs.php.net/viewvc.cgi/pecl/phar/phar.c?r1=1.135&r2=1.136
Previous Comments:
------------------------------------------------------------------------
[2007-01-22 09:46:45] tony2001@php.net
I have to say, I can't reproduce it on my Suse either.
4 tests fail, but the ones you mentioned work fine.
Btw, phar_oo_compressed_001.phpt fails because of several leaks:
016+ /local/dev/php/5_2/main/streams/streams.c(386) : Stream of type
'MEMORY' 0x40203094 (path:(null)) was not closed
017+ /local/dev/php/5_2/main/streams/streams.c(386) : Stream of type
'TEMP' 0x402004f8 (path:(null)) was not closed
You need to close those streams when destroying the object.
------------------------------------------------------------------------
[2007-01-22 08:55:57] mike@php.net
Seems to work fine here... (incidentally same OS and PHP version):
mike@honeybadger:~/cvs/pecl/phar/tests$ php -d"phar.require_hash=0"
-d"phar.readonly=0" phar_oo_compressed_001.phpt
--TEST--
Phar context
--SKIPIF--
--INI--
phar.require_hash=0
phar.readonly=0
--FILE--
string(1) "a"
bool(false)
string(1) "b"
bool(false)
string(1) "c"
bool(false)
string(5) "new a"
bool(false)
string(5) "new b"
bool(true)
string(1) "c"
bool(false)
string(5) "new d"
bool(false)
===DONE===
--CLEAN--
--EXPECTF--
string(1) "a"
bool(false)
string(1) "b"
bool(false)
string(1) "c"
bool(false)
string(5) "new a"
bool(false)
string(5) "new b"
bool(true)
string(1) "c"
bool(false)
string(5) "new d"
bool(false)
===DONE===
mike@honeybadger:~/cvs/pecl/phar/tests$ php -d"phar.require_hash=0"
-d"phar.readonly=0" phar_ctx_001.phpt
--TEST--
Phar context
--SKIPIF--
--INI--
phar.require_hash=0
phar.readonly=0
--FILE--
string(1) "a"
bool(false)
string(1) "b"
bool(false)
string(1) "c"
bool(false)
string(5) "new a"
bool(false)
string(5) "new b"
bool(true)
string(1) "c"
bool(false)
string(5) "new d"
bool(false)
===DONE===
--CLEAN--
--EXPECTF--
string(1) "a"
bool(false)
string(1) "b"
bool(false)
string(1) "c"
bool(false)
string(5) "new a"
bool(false)
string(5) "new b"
bool(true)
string(1) "c"
bool(false)
string(5) "new d"
bool(false)
===DONE===
Tests that fail here:
FAILED TEST SUMMARY
---------------------------------------------------------------------
Phar::mapPhar valid file (bzip2)
[/home/mike/cvs/pecl/phar/tests/015b.phpt]
Phar::mapPhar invalid file (gzipped file length is too short)
[/home/mike/cvs/pecl/phar/tests/016.phpt]
Phar::mapPhar invalid file (gzipped file length is too short)
[/home/mike/cvs/pecl/phar/tests/016b.phpt]
Phar: test that refcounting avoids problems with deleting a file
[/home/mike/cvs/pecl/phar/tests/refcount1.phpt]
------------------------------------------------------------------------
[2007-01-22 07:17:03] tony2001@php.net
Sara, could you look into this?
Btw, I can see the very same code in ext/bz2.
------------------------------------------------------------------------
[2007-01-22 02:25:51] cellog@php.net
Description:
------------
run the test pecl/phar/tests/phar_ctx_001.phpt or
pecl/phar/tests/phar_oo_compressed_001.phpt
and you will see an endless loop. The loop happens in
ext/zlib/zlib_filter.c at line 83:
while (bin < bucket->buflen) {
desired = bucket->buflen - bin;
if (desired > data->inbuf_len) {
desired = data->inbuf_len;
}
memcpy(data->strm.next_in, bucket->buf + bin, desired);
data->strm.avail_in = desired;
status = inflate(&(data->strm), flags & PSFS_FLAG_FLUSH_CLOSE ?
Z_FINISH : Z_SYNC_FLUSH);
if (status != Z_OK && status != Z_STREAM_END) {
/* Something bad happened */
php_stream_bucket_delref(bucket TSRMLS_CC);
return PSFS_ERR_FATAL;
}
desired -= data->strm.avail_in; /* desired becomes what we consumed
this round through */
data->strm.next_in = data->inbuf;
data->strm.avail_in = 0;
consumed += desired;
bin += desired;
if (data->strm.avail_out < data->outbuf_len) {
php_stream_bucket *out_bucket;
size_t bucketlen = data->outbuf_len - data->strm.avail_out;
out_bucket = php_stream_bucket_new(stream, estrndup(data->outbuf,
bucketlen), bucketlen, 1, 0 TSRMLS_CC);
php_stream_bucket_append(buckets_out, out_bucket TSRMLS_CC);
data->strm.avail_out = data->outbuf_len;
data->strm.next_out = data->outbuf;
exit_status = PSFS_PASS_ON;
}
}
the loop should exit when desired is set to 0, but doesn't.
The attached patch fixes this issue.
Reproduce code:
---------------
Index: ext/zlib/zlib_filter.c
===================================================================
RCS file: /repository/php-src/ext/zlib/zlib_filter.c,v
retrieving revision 1.6.2.2.2.3
diff -u -r1.6.2.2.2.3 zlib_filter.c
--- ext/zlib/zlib_filter.c 1 Jan 2007 09:36:10 -0000
1.6.2.2.2.3
+++ ext/zlib/zlib_filter.c 22 Jan 2007 02:23:39 -0000
@@ -99,6 +99,10 @@
data->strm.avail_in = 0;
consumed += desired;
bin += desired;
+ if (!desired) {
+ flags |= PSFS_FLAG_FLUSH_CLOSE;
+ break;
+ }
if (data->strm.avail_out < data->outbuf_len) {
php_stream_bucket *out_bucket;
------------------------------------------------------------------------
--
Edit this bug report at http://bugs.php.net/?id=40189&edit=1
Thread (10 messages)