Bug #78326 [NEW]: improper memory deallocation on stream_get_contents() with fixed lenght buffer

From: albertcasademont at gmail dot com Operating system: Alpine Linux 3.10 PHP version: 7.2.21RC1 Package: Streams related Bug Type: Bug Bug description:improper memory deallocation on stream_get_contents() with fixed lenght buffer Description: ------------ When calling stream_get_contents() with a fixed length buffer, the memory allocated for that buffer is not freed even though the actual data might be much shorter than the allocated buffer. This can potentially crash the script just after a couple of stream_get_contents() calls due to memory issues. If we don't specify a fixed lenght buffer, php will correctly reallocate the string to the exact amount of data read. This would also be the expected thing to do even if we fix the buffer length. Test script: --------------- <?php $f = tmpfile(); fwrite($f, '.'); $chunks = array(); for ($i = 0; $i < 1000; ++$i) { rewind($f); $chunks[] = stream_get_contents($f, 1000000); } var_dump(count($chunks)); Expected result: ---------------- int(1000) Actual result: -------------- Fatal error: Allowed memory size of 67108864 bytes exhausted (tried to allocate 1003520 bytes) in /in/HP2U9 on line 9 -- Edit bug report at https://bugs.php.net/bug.php?id=78326&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=78326&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=78326&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=78326&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=78326&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=78326&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=78326&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=78326&r=needscript Try newer version: https://bugs.php.net/fix.php?id=78326&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=78326&r=support Expected behavior: https://bugs.php.net/fix.php?id=78326&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=78326&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=78326&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=78326&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=78326&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=78326&r=dst IIS Stability: https://bugs.php.net/fix.php?id=78326&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=78326&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=78326&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=78326&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=78326&r=mysqlcfg