Fixed bug #62716 (munmap() is called with the incorrect length)

diff --git a/NEWS b/NEWS
index b836d4f680086d1464534e51e0afa9cea014d33b..97fc6d626d657f37cb095d7c7e5ad333826c0581 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2012, PHP 5.3.16
 
 - Core:
+  . Fixed bug #62716 (munmap() is called with the incorrect length). 
+    (slangley@google.com)
   . Fixed bug #60194 (--with-zend-multibyte and --enable-debug reports LEAK
     with run-test.php). (Laruence)
 

diff --git a/Zend/zend_stream.c b/Zend/zend_stream.c
index 5a02ecdfaef30f7461a4671d906e8e6ccfc27950..bc5206c12c7bd14b23c6d9dbf6f83974611b81b0 100644 (file)
--- a/Zend/zend_stream.c
+++ b/Zend/zend_stream.c
@@ -79,7 +79,7 @@ static size_t zend_stream_stdio_fsizer(void *handle TSRMLS_DC) /* {{{ */
 static void zend_stream_unmap(zend_stream *stream TSRMLS_DC) { /* {{{ */
 #if HAVE_MMAP
        if (stream->mmap.map) {
-               munmap(stream->mmap.map, stream->mmap.len);
+               munmap(stream->mmap.map, stream->mmap.len + ZEND_MMAP_AHEAD);
        } else
 #endif
        if (stream->mmap.buf) {