|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2004-03-24 10:12 UTC] xuefer at 21cn dot com
Description: ------------ file at: http://games.oursky.net:81/125-bad.swf (file will be removed when this bug is closed) eat up >400MB memory(or page file) pls fix it before 4.3.5 is out. Reproduce code: --------------- wget http://games.oursky.net:81/125-bad.swf php -r 'getimagesize("125-bad.swf")'; PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Mon Dec 08 16:00:01 2025 UTC |
more detail: under xp it eat more and more memory under linux cli: $ php -r "getimagesize('./125-bad.swf');" FATAL: erealloc(): Unable to allocate -2011570176 bytes under linux apache: it crashthe above test verified for php4.3.5 phpinfo() under linux: zlib ZLib Support => enabled Compiled Version => 1.1.4 Linked Version => 1.1.4 but when i compile cvs version of php5, it just works ./configure --disable-all --disable-cgi make ./sapi/cli/php -r 'var_dump(getimagesize("125-bad.swf"));' outputs: bool(false)this bug may be "can't reproduce" not "closed" this is the "fix" with testing code Index: ext/standard/image.c =================================================================== RCS file: /repository/php-src/ext/standard/image.c,v retrieving revision 1.72.2.13 diff -u -r1.72.2.13 image.c --- ext/standard/image.c 12 Nov 2003 22:56:09 -0000 1.72.2.13 +++ ext/standard/image.c 27 Mar 2004 03:11:00 -0000 @@ -196,8 +196,8 @@ long bits; unsigned char a[64]; - unsigned long len=64, szlength; - int factor=1,maxfactor=16; + unsigned long len=64, szlength, maxlength = 50*1024*1024; + int factor=1,maxfactor=8; int slength, status=0; char *b, *buf=NULL, *bufz=NULL; @@ -226,8 +226,13 @@ do { szlength=slength*(1<<factor++); + if (szlength > maxlength) { + break; + } + printf("szlength: %d\n", szlength); buf = (char *) erealloc(buf,szlength); status = uncompress(buf, &szlength, bufz, slength); + printf("status: %d\n", (int) (status == Z_BUF_ERROR)); } while ((status==Z_BUF_ERROR)&&(factor<maxfactor)); if (bufz) { $ make && ./sapi/cli/php -r "var_dump(getimagesize('125-bad.swf'));" Build complete. (It is safe to ignore warnings about tempnam and tmpnam). szlength: 2229880 status: 1 szlength: 4459760 status: 1 szlength: 8919520 status: 1 szlength: 17839040 status: 1 szlength: 35678080 status: 1 bool(false)yes, just a guess because no matter how much memory it alloc, uncompress() just return Z_BUF_ERROR i don't know why this swf is bad, it plays ok in stand alone flashplayer and ie browser by the way, when i test it with a "good" swf, the part of erealloc() don't even executed. In another word, the first uncompress: if (uncompress(b, &len, a, sizeof(a)) != Z_OK) { is Z_OK