php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixed GH-17398: bcmul memory leak (#17615)

Browse Source 
Changed BCG memory allocation to be forcibly released in
PHP_GSHUTDOWN_FUNCTION regardless of refcount.

Fixes #17398
Closes #17615
This commit is contained in:
Saki Takamachi
2025-01-29 19:01:00 +09:00
parent ed1d51fa4f
commit 5a4832f97b
5 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@@ -2,6 +2,8 @@ PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
?? ??? ????, PHP 8.3.18
- BCMath:
. Fixed bug GH-17398 (bcmul memory leak). (SakiTakamachi)
13 Feb 2025, PHP 8.3.17

6
ext/bcmath/bcmath.c
View File

@@ -96,9 +96,9 @@ static PHP_GINIT_FUNCTION(bcmath)
/* {{{ PHP_GSHUTDOWN_FUNCTION */
static PHP_GSHUTDOWN_FUNCTION(bcmath)
{
_bc_free_num_ex(&bcmath_globals->_zero_, 1);
_bc_free_num_ex(&bcmath_globals->_one_, 1);
_bc_free_num_ex(&bcmath_globals->_two_, 1);
bc_force_free_number(&bcmath_globals->_zero_);
bc_force_free_number(&bcmath_globals->_one_);
bc_force_free_number(&bcmath_globals->_two_);
}
/* }}} */

2
ext/bcmath/libbcmath/src/bcmath.h
View File

@@ -87,6 +87,8 @@ typedef struct bc_struct {
void bc_init_numbers(void);
void bc_force_free_number(bc_num *num);
bc_num _bc_new_num_ex(size_t length, size_t scale, bool persistent);
void _bc_free_num_ex(bc_num *num, bool persistent);

7
ext/bcmath/libbcmath/src/init.c
View File

@@ -82,6 +82,13 @@ void bc_init_numbers(void)
BCG(_two_)->n_value[0] = 2;
}
void bc_force_free_number(bc_num *num)
{
pefree((*num)->n_ptr, 1);
pefree(*num, 1);
*num = NULL;
}
/* Make a copy of a number! Just increments the reference count! */
bc_num bc_copy_num(bc_num num)

10
ext/bcmath/tests/gh17398.phpt Normal file
View File

@@ -0,0 +1,10 @@
--TEST--
GH-17398 (bcmul memory leak)
--EXTENSIONS--
bcmath
--FILE--
<?php
bcmul('0', '0', 2147483647);
?>
--EXPECTF--
Fatal error: Allowed memory size of %d bytes exhausted%s(tried to allocate %d bytes) in %s on line %d