|   | php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login | 
| 
 PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits              [2016-07-02 14:43 UTC] cmb@php.net
  [2016-10-17 16:36 UTC] andrey@php.net
  [2025-02-02 22:19 UTC] bukka@php.net
 
-Status:      Open
+Status:      Closed
-Assigned To:
+Assigned To: bukka
  [2025-02-02 22:19 UTC] bukka@php.net
 | |||||||||||||||||||||||||||
|  Copyright © 2001-2025 The PHP Group All rights reserved. | Last updated: Fri Oct 31 21:00:02 2025 UTC | 
Description: ------------ php_tvtoto() in main/php_network.h converts a struct timeval to a timeout in seconds. In some cases php_tvtoto() is called with a large value for tv_sec, causing the resulting integer to overflow. For example with mysqlnd, where the default value for mysqlnd.net_read_timeout is 31536000 (one year, in seconds) poll([{fd=13, events=POLLIN|POLLERR|POLLHUP}], 1, 1471228928) = 1 ([{fd=13, revents=POLLIN}]) #0 0x00007f47000bbe88 in poll () from /lib64/libc.so.6 #1 0x0000000000801399 in php_pollfd_for (stream=<value optimized out>, buf=<value optimized out>, count=<value optimized out>) at /usr/src/php-5.6.17/main/php_network.h:165 #2 php_sockop_write (stream=<value optimized out>, buf=<value optimized out>, count=<value optimized out>) at /usr/src/php-5.6.17/main/streams/xp_socket.c:82 #3 0x000000000047fee0 in php_openssl_sockop_io (read=0, stream=<value optimized out>, buf=<value optimized out>, count=18446744073709551615) at /usr/src/php-5.6.17/ext/openssl/xp_ssl.c:1971 #4 0x00000000007f4457 in _php_stream_write_buffer (stream=0xeadb090, buf=0x148d0780 "e-querylarge-querylarge-querylarge-querylarge-"..., count=25467) at /usr/src/php-5.6.17/main/streams/streams.c:1133 #5 0x00000000007c9eec in php_mysqlnd_net_send_ex_pub (net=0x105bb7e0, buffer=0x148cb2a8 "O\270", count=<value optimized out>, conn_stats=<value optimized out>, error_info=<value optimized out>) at /usr/src/php-5.6.17/ext/mysqlnd/mysqlnd_net.c:447 ... 31536000 * 1000 mod 2^32 = 1471228928 So poll times out after ~17 days instead of 365 days. Test script: --------------- test.php: <?php $db = new mysqli(...); // Prepare large query to fill the output buffer causing mysqlnd // to call php_pollfd_for() $largeSQL = 'SELECT "'. str_repeat('large-query', 1000000) .'"'; $db->query($largeSQL); ?> strace test.php Expected result: ---------------- poll([{fd=4, events=POLLOUT}], 1, 4294967296) = 1 ([{fd=4, revents=POLLOUT}]) (or maybe a timeout of -1 is better) Actual result: -------------- poll([{fd=4, events=POLLOUT}], 1, 1471228928) = 1 ([{fd=4, revents=POLLOUT}])