Bug #71882 [Com]: Negative ftruncate() on php://memory exhausts memory
Edit report at https://bugs.php.net/bug.php?id=71882&edit=1
ID: 71882
Comment by: totszwai at gmail dot com
Reported by: miloslav dot hula at gmail dot com
Summary: Negative ftruncate() on php://memory exhausts memory
Status: Verified
Type: Bug
Package: Streams related
PHP Version: Irrelevant
Block user comment: N
Private report: N
New Comment:
I am running into similar problem, but differently.
I am currently porting a php5.x extension to php7, the test cases ran fine in php5, and failed with
the exact same errors shown here when it tries to allocate custom objects.
mmap() failed: [22] Invalid argument
mmap() failed: [22] Invalid argument
Fatal error: Out of memory (allocated 2097152) (tried to allocate 18446744073709551608 bytes)
This is perhaps, php7 related instead of "PHP version: Irrelevant"?
Previous Comments:
------------------------------------------------------------------------
[2016-06-21 21:10:22] cmb@php.net
ftruncate() expects size as signed integer[1] and passes it on to
_php_stream_truncate_set_size() which expects an unsigned
integer[2]. Obviously, that doesn't work well for negative
integers.
[1] <https://github.com/php/php-src/blob/php-7.0.7/ext/standard/file.c#L1542>
[2] <https://github.com/php/php-src/blob/php-7.0.7/main/php_streams.h#L430>
------------------------------------------------------------------------
[2016-03-22 20:26:49] miloslav dot hula at gmail dot com
Description:
------------
Calling ftruncate() with negative index on php://memory leads to memory exhaustion and fatal error.
https://3v4l.org/k720s
Test script:
---------------
<?php
$fd = fopen("php://memory", "w+");
ftruncate($fd, -1);
Expected result:
----------------
(nothing)
Actual result:
--------------
Fatal error: Out of memory (allocated 2097152) (tried to allocate 18446744073709551615 bytes) in
/in/k720s on line 4
mmap() failed: [22] Invalid argument
mmap() failed: [22] Invalid argument
Process exited with code 255.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71882&edit=1
Thread (5 messages)