Fixed bug #48034 (PHP crashes when script is 8192 (8KB) bytes long)

diff --git a/NEWS b/NEWS
index dfd148e5db115547297cbaeea84ef1e9d01af7a1..6b9791bb5cc6b17d045216ca31310e6668c31c9a 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ PHP                                                                        NEWS
 
 - Fixed bug #48087 (call_user_method() invalid free of arguments). (Felipe)
 - Fixed bug #48060 (pdo_pgsql - large objects are returned as empty). (Matteo)
+- Fixed bug #48034 (PHP crashes when script is 8192 (8KB) bytes long). (Dmitry)
 - Fixed bug #48023 (spl_autoload_register didn't store closures). (Etienne)
 - Fixed bug #48004 (Error handler prevents creation of default object).
   (Dmitry)

diff --git a/main/main.c b/main/main.c
index dde90c1389d1a252f3b41620b484e044a2d85b8a..107be035c35a0ade513bf6e2b9b03738f036df61 100644 (file)
--- a/main/main.c
+++ b/main/main.c
@@ -89,6 +89,13 @@
 
 #include "SAPI.h"
 #include "rfc1867.h"
+
+#if HAVE_SYS_MMAN_H
+# include <sys/mman.h>
+# ifndef PAGE_SIZE
+#  define PAGE_SIZE 4096
+# endif
+#endif
 /* }}} */
 
 PHPAPI int (*php_register_internal_extensions_func)(TSRMLS_D) = php_register_internal_extensions;
@@ -1134,8 +1141,10 @@ PHPAPI int php_stream_open_for_zend_ex(const char *filename, zend_file_handle *h
                handle->handle.stream.isatty  = 0;
                /* can we mmap immeadiately? */
                memset(&handle->handle.stream.mmap, 0, sizeof(handle->handle.stream.mmap));
-               len = php_zend_stream_fsizer(stream TSRMLS_CC) + ZEND_MMAP_AHEAD;
-               if (php_stream_mmap_possible(stream)
+               len = php_zend_stream_fsizer(stream TSRMLS_CC);
+               if (len != 0
+               && ((len - 1) % PAGE_SIZE) <= PAGE_SIZE - ZEND_MMAP_AHEAD
+               && php_stream_mmap_possible(stream)
                && (p = php_stream_mmap_range(stream, 0, len, PHP_STREAM_MAP_MODE_SHARED_READONLY, &mapped_len)) != NULL) {
                        handle->handle.stream.closer   = php_zend_stream_mmap_closer;
                        handle->handle.stream.mmap.buf = p;