|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #29838 Memory leak in sprintf argument swapping
Submitted: 2004-08-25 17:15 UTC Modified: 2004-08-26 15:42 UTC
From: tim at digicol dot de Assigned:
Status: Closed Package: Strings related
PHP Version: 4.3.8 OS: SuSE Linux 8.2 (i586)
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
Block user comment
Status: Assign to:
Bug Type:
From: tim at digicol dot de
New email:
PHP Version: OS:


 [2004-08-25 17:15 UTC] tim at digicol dot de
Using argument swapping in sprintf() or printf() calls makes PHP leak memory. (I've been running this code using the PHP CLI binary.)

Have been able to reproduce this with PHP 4.3.7 as well.

./configure --with-config-file-path=/usr/local/php/conf --enable-cli --enable-track-vars --disable-magic-quotes --enable-xml --enable-sysvsem --enable-sysvshm --with-apxs=/usr/local/apache/bin/apxs --disable-debug --enable-ftp --enable-wddx --enable-sigchild --enable-inline-optimization --enable-exif --with-pgsql=/usr/local/pgsql --prefix=/usr/local/php --with-oci8=/dot/oracle/product/9.2.0 --with-db3=/usr/local/db3 --with-zlib --with-dom --with-gd --with-mhash=/usr/local/mhash --enable-mbstring=all --enable-mbstr-enc-trans --enable-mbregex --disable-pic --with-gdbm --enable-pcntl --enable-sysvmsg --with-iconv=/dot/local/iconv --enable-memory-limit

Reproduce code:

$b = memory_get_usage();

$location = "zoo";
$num = 2;

// No memory leak:
// $format = "The %s contains %s monkeys\n";

// Memory leak:
$format = "The %2\$s contains %1\$d monkeys\n";

for ($i = 1; $i <= 100000; $i++)
  sprintf($format, $num, $location);

echo "Grown by " . (memory_get_usage() - $b) . "\n";


Expected result:
Grown by 376

Actual result:
Grown by 4000336


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2004-08-25 17:27 UTC] tim at digicol dot de
Also happens on PHP 4.3.9RC1 ...
 [2004-08-26 02:04 UTC]
Thank you for taking the time to write to us, but this is not
a bug. Please double-check the documentation available at and the instructions on how to report
a bug at

You created 100000 temporary variables inside PHP, what do 
you expect... 
 [2004-08-26 09:31 UTC] tim at digicol dot de
This is *not* bogus.

Small code change - assign the sprintf() result to $x:

for ($i = 1; $i <= 100000; $i++)
  $x = sprintf($format, $num, $location);

Same result, still leaks memory. I don't see 100000 temporary variables here, just $i, $x, $format, $num, $location.
 [2004-08-26 09:35 UTC] tim at digicol dot de
Or try printf() instead:

for ($i = 1; $i <= 100000; $i++)
  printf($format, $num, $location);

Leaks memory as well.
 [2004-08-26 09:42 UTC] tim at digicol dot de
(Sorry to get on your nerves...)

Please try the other format string I commented with "No memory leak".

The memory leak really only occurs when the format string uses argument swapping.
 [2004-08-26 15:28 UTC] tim at digicol dot de
(More annoying comments:)

This memory leak does *not* happen with PHP 4.3.4.

Maybe the memory leak was introduced with the bug fix for bug #26878?
 [2004-08-26 15:42 UTC]
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
Thank you for the report, and for helping us make PHP better.

PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Apr 20 01:01:28 2024 UTC