Bug #81070 [PATCH]: Integer underflow in memory limit comparison
Edit report at https://bugs.php.net/bug.php?id=81070&edit=1
ID: 81070
Patch added by: pvandommelen@gmail.com
Reported by: pvandommelen at gmail dot com
Summary: Integer underflow in memory limit comparison
Status: Open
Type: Bug
Package: Scripting Engine problem
PHP Version: 7.3.28
Block user comment: N
Private report: N
New Comment:
The following pull request has been associated:
Patch Name: Fix #81070: Integer underflow when memory limit is exceeded
On GitHub: https://github.com/php/php-src/pull/7040
Patch: https://github.com/php/php-src/pull/7040.patch
Previous Comments:
------------------------------------------------------------------------
[2021-05-22 10:53:32] pvandommelen at gmail dot com
Browser autofilled the title an old bug report
------------------------------------------------------------------------
[2021-05-22 10:46:04] pvandommelen at gmail dot com
Description:
------------
When more memory is allocated, the currently allocated memory is compared to the limit. There is
currently an integer underflow problem when the limit is lower than the currently allocated memory.
This can occur when the memory limit is changed dynamically through
set_ini("memory_limit", ..).
This was introduced in 7.2.23 and also exists in 7.3.10 and all versions of 7.4 and 8.0.
https://github.com/php/php-src/commit/16d35eb643bf974554e5264021ee10fc969e2053
The code sample illustrates the problem. Allocation after the memory limit is reduced should throw
an error.
The old behaviour can probably be reintroduced by also verifying that the memory limit is higher
than the currently allocated memory.
Test script:
---------------
https://3v4l.org/egq60
```
<?php
echo sprintf("\n%.1fMB", memory_get_usage(true) / 1024 / 1024);
// allocate a large byte string of around 5 MB
$a = str_repeat("0", 5 * 1024 * 1024);
echo sprintf("\n%.1fMB", memory_get_usage(true) / 1024 / 1024);
// setting the memory limit lower than the current is accepted
ini_set("memory_limit", "3M");
echo sprintf("\n%.1fMB", memory_get_usage(true) / 1024 / 1024);
// further allocation beyond the limit
$b = str_repeat("0", 5 * 1024 * 1024);
echo sprintf("\n%.1fMB", memory_get_usage(true) / 1024 / 1024);
```
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=81070&edit=1
Thread (4 messages)