php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #71882 Negative ftruncate() on php://memory exhausts memory
Submitted: 2016-03-22 20:26 UTC Modified: 2016-08-29 15:57 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:1 (100.0%)
From: miloslav dot hula at gmail dot com Assigned: cmb (profile)
Status: Closed Package: Streams related
PHP Version: Irrelevant OS:
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: miloslav dot hula at gmail dot com
New email:
PHP Version: OS:

 

 [2016-03-22 20:26 UTC] miloslav dot hula at gmail dot com 
Description:
------------
Calling ftruncate() with negative index on php://memory leads to memory exhaustion and fatal error.

https://3v4l.org/k720s

Test script:
---------------
<?php

$fd = fopen("php://memory", "w+");
ftruncate($fd, -1);

Expected result:
----------------
(nothing)

Actual result:
--------------
Fatal error: Out of memory (allocated 2097152) (tried to allocate 18446744073709551615 bytes) in /in/k720s on line 4

mmap() failed: [22] Invalid argument
mmap() failed: [22] Invalid argument

Process exited with code 255.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-06-21 21:10 UTC] cmb@php.net
-Status: Open +Status: Verified
 [2016-06-21 21:10 UTC] cmb@php.net 
ftruncate() expects size as signed integer[1] and passes it on to
_php_stream_truncate_set_size() which expects an unsigned
integer[2]. Obviously, that doesn't work well for negative
integers.

[1] <https://github.com/php/php-src/blob/php-7.0.7/ext/standard/file.c#L1542>
[2] <https://github.com/php/php-src/blob/php-7.0.7/main/php_streams.h#L430>
 [2016-08-12 13:00 UTC] totszwai at gmail dot com 
I am running into similar problem, but differently.
I am currently porting a php5.x extension to php7, the test cases ran fine in php5, and failed with the exact same errors shown here when it tries to allocate custom objects.

mmap() failed: [22] Invalid argument
mmap() failed: [22] Invalid argument
Fatal error: Out of memory (allocated 2097152) (tried to allocate 18446744073709551608 bytes)

This is perhaps, php7 related instead of "PHP version: Irrelevant"?
 [2016-08-29 15:55 UTC] cmb@php.net 
@totszwai Yours is another issue, as <https://3v4l.org/k720s>
shows (which also exhibits this behavior under PHP 5), albeit
apparently also caused by a respective signed to unsigned
conversion. Please open another ticket, and supply a test script.
 [2016-08-29 15:57 UTC] cmb@php.net
-Assigned To: +Assigned To: cmb
 [2016-08-30 00:30 UTC] cmb@php.net 
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=207dab585aadd9f320976a0895734d7d9ca7b862
Log: Fix #71882: Negative ftruncate() on php://memory exhausts memory
 [2016-08-30 00:30 UTC] cmb@php.net
-Status: Verified +Status: Closed
 [2016-08-31 12:34 UTC] cmb@php.net 
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=f215fb874ff30cf9be6322210c58021e75a7c393
Log: Fix #71882 amendment: Negative ftruncate() on php://memory exhausts memory
 [2016-08-31 12:56 UTC] cmb@php.net 
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=314a9f8553625eec8f5cfc60360790533d786bc5
Log: Fix #71882 amendment: Negative ftruncate() on php://memory exhausts memory
 [2016-08-31 14:59 UTC] cmb@php.net 
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=b2d267d9ee034fa6b502901caa9a81bcc2212755
Log: Fix #71882 amendment 2: Negative ftruncate() on php://memory exhausts memory
 [2016-10-17 10:08 UTC] bwoebi@php.net 
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=b2d267d9ee034fa6b502901caa9a81bcc2212755
Log: Fix #71882 amendment 2: Negative ftruncate() on php://memory exhausts memory
 [2016-10-17 10:08 UTC] bwoebi@php.net 
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=314a9f8553625eec8f5cfc60360790533d786bc5
Log: Fix #71882 amendment: Negative ftruncate() on php://memory exhausts memory
 [2016-10-17 10:08 UTC] bwoebi@php.net 
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=f215fb874ff30cf9be6322210c58021e75a7c393
Log: Fix #71882 amendment: Negative ftruncate() on php://memory exhausts memory
 [2016-10-17 10:08 UTC] bwoebi@php.net 
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=207dab585aadd9f320976a0895734d7d9ca7b862
Log: Fix #71882: Negative ftruncate() on php://memory exhausts memory
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 10:01:29 2024 UTC