#35690 [NEW]: pack() allocates 1GB memory on float-values.
From: hn at ondskap dot net
Operating system: Linux, Windows Server 2003
PHP version: 5.1.1
PHP Bug Type: Unknown/Other Function
Bug description: pack() allocates 1GB memory on float-values.
Description:
------------
Weird stuff going on with pack().
pack("A*", $float) makes the process go in to a endless loop (if you turn
off memory limit), and kills the apache-thread (and probably server too if
it's a slow one), trying to allocate ~1GB memory.
It's important to check all user-inputs to the pack()-function as it might
hang the server for a while.
From the PHP-doc: "Also note that PHP internally stores integer values as
signed values of a machine dependent size. If you give it an unsigned
integer value too large to be stored that way it is converted to a float
which often yields an undesired result."
(Including php-version 5.1.1)
Reproduce code:
---------------
<?php
echo pack( "A*", 1.0 );
?>
FATAL: emalloc(): Unable to allocate 1072693249 bytes
<?php
echo strlen( pack( "A*", (int) "heh" ));
// Returns 3 all though we cast an integer to it?
?>
Expected result:
----------------
A fatal error on emalloc() that's unable to allocate an machine dependent
amount of memory.
--
Edit bug report at http://bugs.php.net/?id=35690&edit=1
--
Try a CVS snapshot (PHP 4.4): http://bugs.php.net/fix.php?id=35690&r=trysnapshot44
Try a CVS snapshot (PHP 5.1): http://bugs.php.net/fix.php?id=35690&r=trysnapshot51
Try a CVS snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=35690&r=trysnapshot60
Fixed in CVS: http://bugs.php.net/fix.php?id=35690&r=fixedcvs
Fixed in release: http://bugs.php.net/fix.php?id=35690&r=alreadyfixed
Need backtrace: http://bugs.php.net/fix.php?id=35690&r=needtrace
Need Reproduce Script: http://bugs.php.net/fix.php?id=35690&r=needscript
Try newer version: http://bugs.php.net/fix.php?id=35690&r=oldversion
Not developer issue: http://bugs.php.net/fix.php?id=35690&r=support
Expected behavior: http://bugs.php.net/fix.php?id=35690&r=notwrong
Not enough info: http://bugs.php.net/fix.php?id=35690&r=notenoughinfo
Submitted twice: http://bugs.php.net/fix.php?id=35690&r=submittedtwice
register_globals: http://bugs.php.net/fix.php?id=35690&r=globals
PHP 3 support discontinued: http://bugs.php.net/fix.php?id=35690&r=php3
Daylight Savings: http://bugs.php.net/fix.php?id=35690&r=dst
IIS Stability: http://bugs.php.net/fix.php?id=35690&r=isapi
Install GNU Sed: http://bugs.php.net/fix.php?id=35690&r=gnused
Floating point limitations: http://bugs.php.net/fix.php?id=35690&r=float
No Zend Extensions: http://bugs.php.net/fix.php?id=35690&r=nozend
MySQL Configuration Error: http://bugs.php.net/fix.php?id=35690&r=mysqlcfg
Thread (2 messages)
- hn at ondskap dot net