diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-07-29 17:34:21 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-07-29 17:34:37 +0200 |
| commit | 536c91c535d5113aabd2a65b2021a70dc1841d89 (patch) | |
| tree | 56976027f885fef4ea4c59b03339eae2d8cdb404 | |
| parent | 6df1665bb3d5b5d8f799ec40b27463df2b630c51 (diff) | |
| parent | 44fe025c2839b9da51c3b0a0ea90382ac9c14fd4 (diff) | |
| download | php-git-536c91c535d5113aabd2a65b2021a70dc1841d89.tar.gz | |
Merge branch 'PHP-7.3' into PHP-7.4
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/standard/tests/streams/bug78326.phpt | 18 | ||||
| -rw-r--r-- | ext/standard/tests/streams/bug78326_1.phpt | 10 | ||||
| -rw-r--r-- | main/streams/streams.c | 7 |
4 files changed, 38 insertions, 1 deletions
@@ -18,6 +18,10 @@ PHP NEWS - Opcache: . Fixed bug #78341 (Failure to detect smart branch in DFA pass). (Nikita) +- Standard: + . Fixed bug #78326 (improper memory deallocation on stream_get_contents() + with fixed length buffer). (Albert Casademont) + 25 Jul 2019, PHP 7.4.0beta1 - Core: diff --git a/ext/standard/tests/streams/bug78326.phpt b/ext/standard/tests/streams/bug78326.phpt new file mode 100644 index 0000000000..ca27b05f62 --- /dev/null +++ b/ext/standard/tests/streams/bug78326.phpt @@ -0,0 +1,18 @@ +--TEST-- +memory allocation on stream_get_contents() +--INI-- +memory_limit=32M +--FILE-- +<?php +$f = tmpfile(); +fwrite($f, '.'); + +$chunks = array(); +for ($i = 0; $i < 1000; ++$i) { + rewind($f); + $chunks[] = stream_get_contents($f, 1000000); +} +var_dump(count($chunks)); +?> +--EXPECT-- +int(1000) diff --git a/ext/standard/tests/streams/bug78326_1.phpt b/ext/standard/tests/streams/bug78326_1.phpt new file mode 100644 index 0000000000..8e3489db53 --- /dev/null +++ b/ext/standard/tests/streams/bug78326_1.phpt @@ -0,0 +1,10 @@ +--TEST-- +proper string length on stream_get_contents() +--FILE-- +<?php +$f = fopen('php://memory', 'rw'); +fwrite($f, str_repeat('X', 1000)); +fseek($f, 0); +var_dump(strlen(stream_get_contents($f, 1024))); +--EXPECT-- +int(1000) diff --git a/main/streams/streams.c b/main/streams/streams.c index 45bdc828b9..7d81644724 100644 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -1472,8 +1472,13 @@ PHPAPI zend_string *_php_stream_copy_to_mem(php_stream *src, size_t maxlen, int ptr += ret; } if (len) { - *ptr = '\0'; ZSTR_LEN(result) = len; + ZSTR_VAL(result)[len] = '\0'; + + /* Only truncate if the savings are large enough */ + if (len < maxlen / 2) { + result = zend_string_truncate(result, len, persistent); + } } else { zend_string_free(result); result = NULL; |