Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)

diff --git a/Zend/tests/bug44069.phpt b/Zend/tests/bug44069.phpt
new file mode 100644 (file)
index 0000000..75beaaf
--- /dev/null
+++ b/Zend/tests/bug44069.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #44069 (Huge memory usage with concatenation using . instead of .=)
+--FILE--
+<?php
+$array = array();
+$newstring = "";
+$string = str_repeat('This is a teststring.', 50);
+for($i = 1; $i <= 2000; $i++)
+{
+//     $newstring .= $string; //This uses an expected amount of mem.
+       $newstring = $newstring . $string; //This uses very much mem.
+
+       for($j = 1; $j <= 10; $j++)
+       {
+               $array[] = 'test';
+       }
+}
+echo "ok\n";
+?>
+--EXPECT--
+ok

diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 2b53945bc84618734f1ca603368917612c910b65..b66db7937f6e61bc4a2ca34dc550a85215cb08cc 100644 (file)
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -1748,6 +1748,7 @@ static void *_zend_mm_alloc_int(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
        size_t remaining_size;
        size_t segment_size;
        zend_mm_segment *segment;
+       int keep_rest = 0;
 
        if (EXPECTED(ZEND_MM_SMALL_SIZE(true_size))) {
                size_t index = ZEND_MM_BUCKET_INDEX(true_size);
@@ -1816,6 +1817,7 @@ static void *_zend_mm_alloc_int(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
                           segment must have header "size" and trailer "guard" block */
                        segment_size = true_size + ZEND_MM_ALIGNED_SEGMENT_SIZE + ZEND_MM_ALIGNED_HEADER_SIZE;
                        segment_size = (segment_size + (heap->block_size-1)) & ~(heap->block_size-1);
+                       keep_rest = 1;
                } else {
                        segment_size = heap->block_size;
                }
@@ -1895,7 +1897,11 @@ zend_mm_finished_searching_for_block:
                ZEND_MM_BLOCK(new_free_block, ZEND_MM_FREE_BLOCK, remaining_size);
 
                /* add the new free block to the free list */
-               zend_mm_add_to_free_list(heap, new_free_block);
+               if (EXPECTED(!keep_rest)) {
+                       zend_mm_add_to_free_list(heap, new_free_block);
+               } else {
+                       zend_mm_add_to_rest_list(heap, new_free_block);
+               }
        }
 
        ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 1);