php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #62716 munmap() is called with the incorrect length
Submitted: 2012-08-01 11:55 UTC Modified: 2012-08-02 04:28 UTC
From: slangley at google dot com Assigned: laruence (profile)
Status: Closed Package: Scripting Engine problem
PHP Version: 5.3.15 OS: All
Private report: No CVE-ID: None
 [2012-08-01 11:55 UTC] slangley at google dot com
Description:
------------
In zend_stream.cc the size passed to mmap is the size of the file + 
ZEND_MMAP_AHEAD.

*buf = mmap(0, size + ZEND_MMAP_AHEAD, PROT_READ, MAP_PRIVATE, 
fileno(file_handle->handle.fp), 0);

However, when munmap() is called the incorrect size is passed.

static void zend_stream_unmap(zend_stream *stream TSRMLS_DC) { /* {{{ */
#if HAVE_MMAP
        if (stream->mmap.map) {
                munmap(stream->mmap.map, stream->mmap.len);
        } else
#endif


The call to munmap should be

munmap(stream->mmap.map, stream->mmap.len + ZEND_MMAP_AHEAD);

Test script:
---------------
N/A

Expected result:
----------------
N/A

Actual result:
--------------
N/A

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-08-02 04:28 UTC] laruence@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 [2012-08-02 04:28 UTC] laruence@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: laruence
 [2012-08-02 04:28 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=433089ccb4d4747a01d522e8678664ff17584615
Log: Fixed bug #62716 (munmap() is called with the incorrect length)
 [2012-08-02 04:31 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=433089ccb4d4747a01d522e8678664ff17584615
Log: Fixed bug #62716 (munmap() is called with the incorrect length)
 [2012-08-02 04:32 UTC] laruence@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src.git;a=commit;h=433089ccb4d4747a01d522e8678664ff17584615
Log: Fixed bug #62716 (munmap() is called with the incorrect length)
 [2014-10-07 23:23 UTC] stas@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=433089ccb4d4747a01d522e8678664ff17584615
Log: Fixed bug #62716 (munmap() is called with the incorrect length)
 [2014-10-07 23:34 UTC] stas@php.net
Automatic comment on behalf of laruence
Revision: http://git.php.net/?p=php-src-security.git;a=commit;h=433089ccb4d4747a01d522e8678664ff17584615
Log: Fixed bug #62716 (munmap() is called with the incorrect length)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Thu Nov 21 15:01:30 2024 UTC