php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #35690 pack() allocates 1GB memory on float-values.
Submitted: 2005-12-15 20:51 UTC Modified: 2005-12-15 23:15 UTC
Votes:3
Avg. Score:3.0 ± 0.8
Reproduced:3 of 3 (100.0%)
Same Version:2 (66.7%)
Same OS:3 (100.0%)
From: hn at ondskap dot net Assigned:
Status: Closed Package: Unknown/Other Function
PHP Version: 5.1.1 OS: Linux, Windows Server 2003
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: hn at ondskap dot net
New email:
PHP Version: OS:

 

 [2005-12-15 20:51 UTC] hn at ondskap dot net
Description:
------------
Weird stuff going on with pack().

pack("A*", $float) makes the process go in to a endless loop (if you turn off memory limit), and kills the apache-thread (and probably server too if it's a slow one), trying to allocate ~1GB memory.

It's important to check all user-inputs to the pack()-function as it might hang the server for a while.

From the PHP-doc: "Also note that PHP internally stores integer values as signed values of a machine dependent size. If you give it an unsigned integer value too large to be stored that way it is converted to a float which often yields an undesired result."

(Including php-version 5.1.1)


Reproduce code:
---------------
<?php
   echo pack( "A*", 1.0 );
?>
FATAL:  emalloc():  Unable to allocate 1072693249 bytes


<?php
   echo strlen( pack( "A*", (int) "heh" ));
   // Returns 3 all though we cast an integer to it?
?>

Expected result:
----------------
A fatal error on emalloc() that's unable to allocate an machine dependent amount of memory.


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-12-15 23:15 UTC] tony2001@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 11:01:29 2024 UTC