Fixed bug #55509 (segfault on x86_64 using more than 2G memory). (Laruence)

diff --git a/NEWS b/NEWS
index c6506b4e74a4c118b4c1388185d58d4c387d4457..57b4f970d1ae0f77e59f3bc89defcd6fa249fad2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
   . Fixed bug #55366: keys lost when using substr_replace an array. (Arpad)
   . Fixed bug #55510: $_FILES 'name' missing first character after upload.
     (Arpad)
+  . Fixed bug #55509 (segfault on x86_64 using more than 2G memory). (Laruence)
   . Fixed bug #55576: Cannot conditionally move uploaded file without race
     condition. (Gustavo)
   . Fixed bug #55504 (Content-Type header is not parsed correctly on

diff --git a/Zend/tests/bug55509.phpt b/Zend/tests/bug55509.phpt
new file mode 100644 (file)
index 0000000..86e5a08
--- /dev/null
+++ b/Zend/tests/bug55509.phpt
@@ -0,0 +1,33 @@
+--TEST--\r
+Bug #55509 (segfault on x86_64 using more than 2G memory)\r
+--SKIPIF--\r
+<?php\r
+if (PHP_INT_SIZE == 4) {\r
+  die('skip Not for 32-bits OS');\r
+}\r
+?>\r
+--INI--\r
+memory_limit=3G\r
+--FILE--\r
+<?php\r
+$a1 = str_repeat("1", 1024 * 1024 * 1024 * 0.5);\r
+echo "1\n";\r
+$a2 = str_repeat("2", 1024 * 1024 * 1024 * 0.5);\r
+echo "2\n";\r
+$a3 = str_repeat("3", 1024 * 1024 * 1024 * 0.5);\r
+echo "3\n";\r
+$a4 = str_repeat("4", 1024 * 1024 * 1024 * 0.5);\r
+echo "4\n";\r
+$a5 = str_repeat("5", 1024 * 1024 * 1024 * 0.5);\r
+echo "5\n";\r
+$a6 = str_repeat("6", 1024 * 1024 * 1024 * 0.5);\r
+echo "6\n";\r
+?>\r
+--EXPECTF--\r
+1\r
+2\r
+3\r
+4\r
+5\r
+\r
+Fatal error: Allowed memory size of %d bytes exhausted (tried to allocate %d bytes) in %s/bug55509.php on line %d\r

diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 88944b45a2acbe7331e2cbcf33a91c24bc746f77..4af99ee278646277b3679f26959c2da9ce13787f 100644 (file)
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -510,7 +510,7 @@ static unsigned int _zend_mm_cookie = 0;
 #define ZEND_MM_IS_GUARD_BLOCK(b)              (((b)->info._size & ZEND_MM_TYPE_MASK) == ZEND_MM_GUARD_BLOCK)
 
 #define ZEND_MM_NEXT_BLOCK(b)                  ZEND_MM_BLOCK_AT(b, ZEND_MM_BLOCK_SIZE(b))
-#define ZEND_MM_PREV_BLOCK(b)                  ZEND_MM_BLOCK_AT(b, -(int)((b)->info._prev & ~ZEND_MM_TYPE_MASK))
+#define ZEND_MM_PREV_BLOCK(b)                  ZEND_MM_BLOCK_AT(b, -(ssize_t)((b)->info._prev & ~ZEND_MM_TYPE_MASK))
 
 #define ZEND_MM_PREV_BLOCK_IS_FREE(b)  (!((b)->info._prev & ZEND_MM_USED_BLOCK))