diff options
author | Nikita Popov <nikita.ppv@gmail.com> | 2019-07-16 13:27:41 +0200 |
---|---|---|
committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-07-16 15:47:10 +0200 |
commit | 5161cebe28cca36fa7f7989b5a799290a3f1eb6a (patch) | |
tree | 75cb905c499a7b673445394b3af858116d2e5c31 /sapi/cli/php_cli.c | |
parent | 292354f73ae7b55c062d0a0fc9cc34a8d761cd21 (diff) | |
download | php-git-5161cebe28cca36fa7f7989b5a799290a3f1eb6a.tar.gz |
Fix bug #52752 by not using mmap() to lex files
Using mmap() is unsafe under concurrent modification. If the file
is truncated, access past the end of the file may occur, which will
generate a SIGBUS error. Even if the length does not change, the
contents may, which is a situation that the lexer certainly is not
prepared to deal with either.
Reproduce with test.php:
<?php
file_put_contents(__DIR__ . '/test.tpl',
'AAA<?php $string = "' .
str_repeat('A', mt_rand(1, 256 * 1024)) .
'"; ?>BBB' . "\r\n");
require_once __DIR__ . '/test.tpl';
And:
for ((n=0;n<100;n++)); do sapi/cli/php test.php & done
Diffstat (limited to 'sapi/cli/php_cli.c')
0 files changed, 0 insertions, 0 deletions