diff options
| author | Adam Seitz <adamjseitz@gmail.com> | 2020-12-02 00:40:16 +0100 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-12-23 13:49:56 +0100 |
| commit | 70dfbe00684eb1c31d5b49f643e4736696c3b7df (patch) | |
| tree | 3e43f4d84fff8ea5c71fbf429ca4ce625119d138 /main | |
| parent | b043759cb42b33e02359ca1c30d8d5b68d8a015e (diff) | |
| download | php-git-70dfbe00684eb1c31d5b49f643e4736696c3b7df.tar.gz | |
Fix #80384: limit read buffer size
In the case of a stream with no filters, php_stream_fill_read_buffer
only reads stream->chunk_size into the read buffer. If the stream has
filters attached, it could unnecessarily buffer a large amount of data.
With this change, php_stream_fill_read_buffer only proceeds until either
the requested size or stream->chunk_size is available in the read buffer.
Co-authored-by: Christoph M. Becker <cmbecker69@gmx.de>
Closes GH-6444.
Diffstat (limited to 'main')
| -rw-r--r-- | main/streams/streams.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/main/streams/streams.c b/main/streams/streams.c index ab413872e0..5f6bf88aa9 100644 --- a/main/streams/streams.c +++ b/main/streams/streams.c @@ -542,6 +542,7 @@ PHPAPI int _php_stream_fill_read_buffer(php_stream *stream, size_t size) /* allocate/fill the buffer */ if (stream->readfilters.head) { + size_t to_read_now = MIN(size, stream->chunk_size); char *chunk_buf; php_stream_bucket_brigade brig_in = { NULL, NULL }, brig_out = { NULL, NULL }; php_stream_bucket_brigade *brig_inp = &brig_in, *brig_outp = &brig_out, *brig_swap; @@ -549,7 +550,7 @@ PHPAPI int _php_stream_fill_read_buffer(php_stream *stream, size_t size) /* allocate a buffer for reading chunks */ chunk_buf = emalloc(stream->chunk_size); - while (!stream->eof && (stream->writepos - stream->readpos < (zend_off_t)size)) { + while (!stream->eof && (stream->writepos - stream->readpos < (zend_off_t)to_read_now)) { ssize_t justread = 0; int flags; php_stream_bucket *bucket; |