From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 13 Sep 2011 07:01:46 +0000 (+0000)
Subject: Fixed bug #55509 (segfault on x86_64 using more than 2G memory). (Laruence)
X-Git-Tag: php-5.5.0alpha1~1161
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b6173bee922363affe761bfaa1f7e7c678e8dd96;p=php

Fixed bug #55509 (segfault on x86_64 using more than 2G memory). (Laruence)
---

diff --git a/Zend/tests/bug55509.phpt b/Zend/tests/bug55509.phpt
new file mode 100644
index 0000000000..86e5a08764
--- /dev/null
+++ b/Zend/tests/bug55509.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #55509 (segfault on x86_64 using more than 2G memory)
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE == 4) {
+  die('skip Not for 32-bits OS');
+}
+?>
+--INI--
+memory_limit=3G
+--FILE--
+<?php
+$a1 = str_repeat("1", 1024 * 1024 * 1024 * 0.5);
+echo "1\n";
+$a2 = str_repeat("2", 1024 * 1024 * 1024 * 0.5);
+echo "2\n";
+$a3 = str_repeat("3", 1024 * 1024 * 1024 * 0.5);
+echo "3\n";
+$a4 = str_repeat("4", 1024 * 1024 * 1024 * 0.5);
+echo "4\n";
+$a5 = str_repeat("5", 1024 * 1024 * 1024 * 0.5);
+echo "5\n";
+$a6 = str_repeat("6", 1024 * 1024 * 1024 * 0.5);
+echo "6\n";
+?>
+--EXPECTF--
+1
+2
+3
+4
+5
+
+Fatal error: Allowed memory size of %d bytes exhausted (tried to allocate %d bytes) in %s/bug55509.php on line %d
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 2d8d26a99f..3c3b579e7b 100644
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -515,7 +515,7 @@ static unsigned int _zend_mm_cookie = 0;
 #define ZEND_MM_IS_GUARD_BLOCK(b)		(((b)->info._size & ZEND_MM_TYPE_MASK) == ZEND_MM_GUARD_BLOCK)
 
 #define ZEND_MM_NEXT_BLOCK(b)			ZEND_MM_BLOCK_AT(b, ZEND_MM_BLOCK_SIZE(b))
-#define ZEND_MM_PREV_BLOCK(b)			ZEND_MM_BLOCK_AT(b, -(int)((b)->info._prev & ~ZEND_MM_TYPE_MASK))
+#define ZEND_MM_PREV_BLOCK(b)			ZEND_MM_BLOCK_AT(b, -(ssize_t)((b)->info._prev & ~ZEND_MM_TYPE_MASK))
 
 #define ZEND_MM_PREV_BLOCK_IS_FREE(b)	(!((b)->info._prev & ZEND_MM_USED_BLOCK))