From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 28 Apr 2009 07:13:30 +0000 (+0000)
Subject: Fixed bug #48034 (PHP crashes when script is 8192 (8KB) bytes long)
X-Git-Tag: php-5.3.0RC2~84
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9e36fae5ff5759dbe010579fff11e1894555a262;p=php

Fixed bug #48034 (PHP crashes when script is 8192 (8KB) bytes long)
---

diff --git a/NEWS b/NEWS
index dfd148e5db..6b9791bb5c 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ PHP                                                                        NEWS
 
 - Fixed bug #48087 (call_user_method() invalid free of arguments). (Felipe)
 - Fixed bug #48060 (pdo_pgsql - large objects are returned as empty). (Matteo)
+- Fixed bug #48034 (PHP crashes when script is 8192 (8KB) bytes long). (Dmitry)
 - Fixed bug #48023 (spl_autoload_register didn't store closures). (Etienne)
 - Fixed bug #48004 (Error handler prevents creation of default object).
   (Dmitry)
diff --git a/main/main.c b/main/main.c
index dde90c1389..107be035c3 100644
--- a/main/main.c
+++ b/main/main.c
@@ -89,6 +89,13 @@
 
 #include "SAPI.h"
 #include "rfc1867.h"
+
+#if HAVE_SYS_MMAN_H
+# include <sys/mman.h>
+# ifndef PAGE_SIZE
+#  define PAGE_SIZE 4096
+# endif
+#endif
 /* }}} */
 
 PHPAPI int (*php_register_internal_extensions_func)(TSRMLS_D) = php_register_internal_extensions;
@@ -1134,8 +1141,10 @@ PHPAPI int php_stream_open_for_zend_ex(const char *filename, zend_file_handle *h
 		handle->handle.stream.isatty  = 0;
 		/* can we mmap immeadiately? */
 		memset(&handle->handle.stream.mmap, 0, sizeof(handle->handle.stream.mmap));
-		len = php_zend_stream_fsizer(stream TSRMLS_CC) + ZEND_MMAP_AHEAD;
-		if (php_stream_mmap_possible(stream)
+		len = php_zend_stream_fsizer(stream TSRMLS_CC);
+		if (len != 0
+		&& ((len - 1) % PAGE_SIZE) <= PAGE_SIZE - ZEND_MMAP_AHEAD
+		&& php_stream_mmap_possible(stream)
 		&& (p = php_stream_mmap_range(stream, 0, len, PHP_STREAM_MAP_MODE_SHARED_READONLY, &mapped_len)) != NULL) {
 			handle->handle.stream.closer   = php_zend_stream_mmap_closer;
 			handle->handle.stream.mmap.buf = p;