php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29838 Memory leak in sprintf argument swapping
Submitted: 2004-08-25 17:15 UTC Modified: 2004-08-26 15:42 UTC
From: tim at digicol dot de Assigned:
Status: Closed Package: Strings related
PHP Version: 4.3.8 OS: SuSE Linux 8.2 (i586)
Private report: No CVE-ID:
 [2004-08-25 17:15 UTC] tim at digicol dot de
Description:
------------
Using argument swapping in sprintf() or printf() calls makes PHP leak memory. (I've been running this code using the PHP CLI binary.)

Have been able to reproduce this with PHP 4.3.7 as well.

./configure --with-config-file-path=/usr/local/php/conf --enable-cli --enable-track-vars --disable-magic-quotes --enable-xml --enable-sysvsem --enable-sysvshm --with-apxs=/usr/local/apache/bin/apxs --disable-debug --enable-ftp --enable-wddx --enable-sigchild --enable-inline-optimization --enable-exif --with-pgsql=/usr/local/pgsql --prefix=/usr/local/php --with-oci8=/dot/oracle/product/9.2.0 --with-db3=/usr/local/db3 --with-zlib --with-dom --with-gd --with-mhash=/usr/local/mhash --enable-mbstring=all --enable-mbstr-enc-trans --enable-mbregex --disable-pic --with-gdbm --enable-pcntl --enable-sysvmsg --with-iconv=/dot/local/iconv --enable-memory-limit

Reproduce code:
---------------
<?php

$b = memory_get_usage();

$location = "zoo";
$num = 2;

// No memory leak:
// $format = "The %s contains %s monkeys\n";

// Memory leak:
$format = "The %2\$s contains %1\$d monkeys\n";

for ($i = 1; $i <= 100000; $i++)
  sprintf($format, $num, $location);

echo "Grown by " . (memory_get_usage() - $b) . "\n";

?>


Expected result:
----------------
Grown by 376

Actual result:
--------------
Grown by 4000336

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2004-08-25 17:27 UTC] tim at digicol dot de
Also happens on PHP 4.3.9RC1 ...
 [2004-08-26 02:04 UTC] iliaa@php.net
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at
http://www.php.net/manual/ and the instructions on how to report
a bug at http://bugs.php.net/how-to-report.php

You created 100000 temporary variables inside PHP, what do 
you expect... 
 [2004-08-26 09:31 UTC] tim at digicol dot de
This is *not* bogus.

Small code change - assign the sprintf() result to $x:

for ($i = 1; $i <= 100000; $i++)
  $x = sprintf($format, $num, $location);

Same result, still leaks memory. I don't see 100000 temporary variables here, just $i, $x, $format, $num, $location.
 [2004-08-26 09:35 UTC] tim at digicol dot de
Or try printf() instead:

for ($i = 1; $i <= 100000; $i++)
  printf($format, $num, $location);

Leaks memory as well.
 [2004-08-26 09:42 UTC] tim at digicol dot de
(Sorry to get on your nerves...)

Please try the other format string I commented with "No memory leak".

The memory leak really only occurs when the format string uses argument swapping.
 [2004-08-26 15:28 UTC] tim at digicol dot de
(More annoying comments:)

This memory leak does *not* happen with PHP 4.3.4.

Maybe the memory leak was introduced with the bug fix for bug #26878?
 [2004-08-26 15:42 UTC] thies@php.net
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Thu Apr 24 02:02:10 2014 UTC