From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 14 Feb 2008 14:42:00 +0000 (+0000)
Subject: Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
X-Git-Tag: RELEASE_1_3_1~47
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e563a6d979538a64d3d78400a799023ee2aabec4;p=php

Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=)
---

diff --git a/Zend/tests/bug44069.phpt b/Zend/tests/bug44069.phpt
new file mode 100644
index 0000000000..75beaafed7
--- /dev/null
+++ b/Zend/tests/bug44069.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #44069 (Huge memory usage with concatenation using . instead of .=)
+--FILE--
+<?php
+$array = array();
+$newstring = "";
+$string = str_repeat('This is a teststring.', 50);
+for($i = 1; $i <= 2000; $i++)
+{
+//	$newstring .= $string; //This uses an expected amount of mem.
+	$newstring = $newstring . $string; //This uses very much mem.
+
+	for($j = 1; $j <= 10; $j++)
+	{
+		$array[] = 'test';
+	}
+}
+echo "ok\n";
+?>
+--EXPECT--
+ok
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 2b53945bc8..b66db7937f 100644
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -1748,6 +1748,7 @@ static void *_zend_mm_alloc_int(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	size_t remaining_size;
 	size_t segment_size;
 	zend_mm_segment *segment;
+	int keep_rest = 0;
 
 	if (EXPECTED(ZEND_MM_SMALL_SIZE(true_size))) {
 		size_t index = ZEND_MM_BUCKET_INDEX(true_size);
@@ -1816,6 +1817,7 @@ static void *_zend_mm_alloc_int(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 			   segment must have header "size" and trailer "guard" block */
 			segment_size = true_size + ZEND_MM_ALIGNED_SEGMENT_SIZE + ZEND_MM_ALIGNED_HEADER_SIZE;
 			segment_size = (segment_size + (heap->block_size-1)) & ~(heap->block_size-1);
+			keep_rest = 1;
 		} else {
 			segment_size = heap->block_size;
 		}
@@ -1895,7 +1897,11 @@ zend_mm_finished_searching_for_block:
 		ZEND_MM_BLOCK(new_free_block, ZEND_MM_FREE_BLOCK, remaining_size);
 
 		/* add the new free block to the free list */
-		zend_mm_add_to_free_list(heap, new_free_block);
+		if (EXPECTED(!keep_rest)) {
+			zend_mm_add_to_free_list(heap, new_free_block);
+		} else {
+			zend_mm_add_to_rest_list(heap, new_free_block);
+		}
 	}
 
 	ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 1);