mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-12-15 12:54:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.1'

Browse Source
This commit is contained in:
Bob Weinand 2017-03-15 00:09:59 +01:00
commit 8a7a1411b9
2 changed files with 32 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
ext/zlib/tests/bug74240.phpt Normal file
View File

@ -0,0 +1,30 @@
--TEST--
Bug #74240 (deflate_add can allocate too much memory)
--SKIPIF--
<?php
if (!extension_loaded("zlib")) {
print "skip - ZLIB extension not loaded";
}
?>
--FILE--
<?php
ini_set('memory_limit', '64M');
$deflator = deflate_init(ZLIB_ENCODING_RAW);
$bytes = str_repeat("*", 65536);
// this crashes after about 500 iterations if PHP is
// configured for 64M
for ($i = 0; $i < 1000; $i++) {
$output = deflate_add(
$deflator,
$bytes,
ZLIB_SYNC_FLUSH
);
}
echo "Completed\n";
?>
--EXPECT--
Completed

6
ext/zlib/zlib.c
View File

@ -1154,10 +1154,8 @@ PHP_FUNCTION(deflate_add)
RETURN_EMPTY_STRING();
}
out_size = PHP_ZLIB_BUFFER_SIZE_GUESS(ctx->total_in + in_len);
out_size = (ctx->total_out >= out_size) ? 16 : (out_size - ctx->total_out);
out_size = (out_size < 16) ? 16 : out_size;
out_size += 64;
out_size = PHP_ZLIB_BUFFER_SIZE_GUESS(in_len);
out_size = (out_size < 64) ? 64 : out_size;
out = zend_string_alloc(out_size, 0);
ctx->next_in = (Bytef *) in_buf;