archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed bug #74240 (deflate_add can allocate too much memory)

Browse source
This commit is contained in:
Matt Bonneau 2017-03-13 00:11:30 -04:00 • committed by Bob Weinand
parent 8be63ce0e2
commit 7fba8bda4c
3 changed files with 36 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

5
NEWS
View file

@ -23,9 +23,12 @@ PHP NEWS
. Fixed bug #71003 (Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to PDO
interface). (Thomas Orozco)
. Streams:
- Streams:
. Fixed bug #74216 (Correctly fail on invalid IP address ports). (Sara)
- Zlib:
. Fixed bug #74240 (deflate_add can allocate too much memory). (Matt Bonneau)
16 Mar 2017 PHP 7.0.17
- Core:

30
ext/zlib/tests/bug74240.phpt Normal file
View file

@ -0,0 +1,30 @@
--TEST--
Bug #74240 (deflate_add can allocate too much memory)
--SKIPIF--
<?php
if (!extension_loaded("zlib")) {
print "skip - ZLIB extension not loaded";
}
?>
--FILE--
<?php
ini_set('memory_limit', '64M');
$deflator = deflate_init(ZLIB_ENCODING_RAW);
$bytes = str_repeat("*", 65536);
// this crashes after about 500 iterations if PHP is
// configured for 64M
for ($i = 0; $i < 1000; $i++) {
$output = deflate_add(
$deflator,
$bytes,
ZLIB_SYNC_FLUSH
);
}
echo "Completed\n";
?>
--EXPECT--
Completed

6
ext/zlib/zlib.c
View file

@ -1154,10 +1154,8 @@ PHP_FUNCTION(deflate_add)
RETURN_EMPTY_STRING();
}
out_size = PHP_ZLIB_BUFFER_SIZE_GUESS(ctx->total_in + in_len);
out_size = (ctx->total_out >= out_size) ? 16 : (out_size - ctx->total_out);
out_size = (out_size < 16) ? 16 : out_size;
out_size += 64;
out_size = PHP_ZLIB_BUFFER_SIZE_GUESS(in_len);
out_size = (out_size < 64) ? 64 : out_size;
out = zend_string_alloc(out_size, 0);
ctx->next_in = (Bytef *) in_buf;