Bug #71882 [Opn->Ver]: Negative ftruncate() on php://memory exhausts memory

From: Date: Tue, 21 Jun 2016 21:10:23 +0000
Subject: Bug #71882 [Opn->Ver]: Negative ftruncate() on php://memory exhausts memory
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-201780@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=71882&edit=1

 ID:                 71882
 Updated by:         cmb@php.net
 Reported by:        miloslav dot hula at gmail dot com
 Summary:            Negative ftruncate() on php://memory exhausts memory
-Status:             Open
+Status:             Verified
 Type:               Bug
 Package:            Streams related
 PHP Version:        Irrelevant
 Block user comment: N
 Private report:     N

 New Comment:

ftruncate() expects size as signed integer[1] and passes it on to
_php_stream_truncate_set_size() which expects an unsigned
integer[2]. Obviously, that doesn't work well for negative
integers.

[1] <https://github.com/php/php-src/blob/php-7.0.7/ext/standard/file.c#L1542>
[2] <https://github.com/php/php-src/blob/php-7.0.7/main/php_streams.h#L430>


Previous Comments:
------------------------------------------------------------------------
[2016-03-22 20:26:49] miloslav dot hula at gmail dot com

Description:
------------
Calling ftruncate() with negative index on php://memory leads to memory exhaustion and fatal error.

https://3v4l.org/k720s

Test script:
---------------
<?php

$fd = fopen("php://memory", "w+");
ftruncate($fd, -1);

Expected result:
----------------
(nothing)

Actual result:
--------------
Fatal error: Out of memory (allocated 2097152) (tried to allocate 18446744073709551615 bytes) in
/in/k720s on line 4

mmap() failed: [22] Invalid argument
mmap() failed: [22] Invalid argument

Process exited with code 255.



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=71882&edit=1

Thread (5 messages)

« previous php.bugs (#201780) next »