Skip to content

Commit 8ce04df

Browse files
committed
Fix #78620: Out of memory error
If the integer addition in `ZEND_MM_ALIGNED_SIZE_EX` overflows, the macro evaluates to `0`, what we should catch early.
1 parent a5d3620 commit 8ce04df

File tree

2 files changed

+6
-0
lines changed

2 files changed

+6
-0
lines changed

NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ PHP NEWS
55
- Core:
66
. Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
77
(bugreportuser)
8+
. Fixed bug #78620 (Out of memory error). (cmb)
89

910
- Exif:
1011
. Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)

Zend/zend_alloc.c

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1730,10 +1730,15 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
17301730
void *ptr;
17311731

17321732
#if ZEND_MM_LIMIT
1733+
if (UNEXPECTED(new_size == 0)) {
1734+
/* overflow in ZEND_MM_ALIGNED_SIZE_EX */
1735+
goto memory_limit_exhausted;
1736+
}
17331737
if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
17341738
if (zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
17351739
/* pass */
17361740
} else if (heap->overflow == 0) {
1741+
memory_limit_exhausted:
17371742
#if ZEND_DEBUG
17381743
zend_mm_safe_error(heap, "Allowed memory size of %zu bytes exhausted at %s:%d (tried to allocate %zu bytes)", heap->limit, __zend_filename, __zend_lineno, size);
17391744
#else

0 commit comments

Comments
 (0)