Bug #81070 [Opn]: Integer underflow in memory limit comparison
Edit report at https://bugs.php.net/bug.php?id=81070&edit=1
ID: 81070
User updated by: pvandommelen at gmail dot com
Reported by: pvandommelen at gmail dot com
-Summary: Regression in 7.4.6 when yielding an array based
generator
+Summary: Integer underflow in memory limit comparison
Status: Open
Type: Bug
Package: Scripting Engine problem
PHP Version: 7.3.28
Block user comment: N
Private report: N
New Comment:
Browser autofilled the title an old bug report
Previous Comments:
------------------------------------------------------------------------
[2021-05-22 10:46:04] pvandommelen at gmail dot com
Description:
------------
When more memory is allocated, the currently allocated memory is compared to the limit. There is
currently an integer underflow problem when the limit is lower than the currently allocated memory.
This can occur when the memory limit is changed dynamically through
set_ini("memory_limit", ..).
This was introduced in 7.2.23 and also exists in 7.3.10 and all versions of 7.4 and 8.0.
https://github.com/php/php-src/commit/16d35eb643bf974554e5264021ee10fc969e2053
The code sample illustrates the problem. Allocation after the memory limit is reduced should throw
an error.
The old behaviour can probably be reintroduced by also verifying that the memory limit is higher
than the currently allocated memory.
Test script:
---------------
https://3v4l.org/egq60
```
<?php
echo sprintf("\n%.1fMB", memory_get_usage(true) / 1024 / 1024);
// allocate a large byte string of around 5 MB
$a = str_repeat("0", 5 * 1024 * 1024);
echo sprintf("\n%.1fMB", memory_get_usage(true) / 1024 / 1024);
// setting the memory limit lower than the current is accepted
ini_set("memory_limit", "3M");
echo sprintf("\n%.1fMB", memory_get_usage(true) / 1024 / 1024);
// further allocation beyond the limit
$b = str_repeat("0", 5 * 1024 * 1024);
echo sprintf("\n%.1fMB", memory_get_usage(true) / 1024 / 1024);
```
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81070&edit=1
Thread (4 messages)