From 12864e4769237c5d1cc01665ed6f688e54e31dcf Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 13 Sep 2011 07:01:46 +0000
Subject: Fixed bug #55509 (segfault on x86_64 using more than 2G memory).
 (Laruence)

---
 Zend/tests/bug55509.phpt | 33 +++++++++++++++++++++++++++++++++
 Zend/zend_alloc.c        |  2 +-
 2 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/bug55509.phpt

(limited to 'Zend')

diff --git a/Zend/tests/bug55509.phpt b/Zend/tests/bug55509.phpt
new file mode 100644
index 0000000000..86e5a08764
--- /dev/null
+++ b/Zend/tests/bug55509.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #55509 (segfault on x86_64 using more than 2G memory)
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE == 4) {
+  die('skip Not for 32-bits OS');
+}
+?>
+--INI--
+memory_limit=3G
+--FILE--
+<?php
+$a1 = str_repeat("1", 1024 * 1024 * 1024 * 0.5);
+echo "1\n";
+$a2 = str_repeat("2", 1024 * 1024 * 1024 * 0.5);
+echo "2\n";
+$a3 = str_repeat("3", 1024 * 1024 * 1024 * 0.5);
+echo "3\n";
+$a4 = str_repeat("4", 1024 * 1024 * 1024 * 0.5);
+echo "4\n";
+$a5 = str_repeat("5", 1024 * 1024 * 1024 * 0.5);
+echo "5\n";
+$a6 = str_repeat("6", 1024 * 1024 * 1024 * 0.5);
+echo "6\n";
+?>
+--EXPECTF--
+1
+2
+3
+4
+5
+
+Fatal error: Allowed memory size of %d bytes exhausted (tried to allocate %d bytes) in %s/bug55509.php on line %d
diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 88944b45a2..4af99ee278 100644
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -510,7 +510,7 @@ static unsigned int _zend_mm_cookie = 0;
 #define ZEND_MM_IS_GUARD_BLOCK(b)		(((b)->info._size & ZEND_MM_TYPE_MASK) == ZEND_MM_GUARD_BLOCK)
 
 #define ZEND_MM_NEXT_BLOCK(b)			ZEND_MM_BLOCK_AT(b, ZEND_MM_BLOCK_SIZE(b))
-#define ZEND_MM_PREV_BLOCK(b)			ZEND_MM_BLOCK_AT(b, -(int)((b)->info._prev & ~ZEND_MM_TYPE_MASK))
+#define ZEND_MM_PREV_BLOCK(b)			ZEND_MM_BLOCK_AT(b, -(ssize_t)((b)->info._prev & ~ZEND_MM_TYPE_MASK))
 
 #define ZEND_MM_PREV_BLOCK_IS_FREE(b)	(!((b)->info._prev & ZEND_MM_USED_BLOCK))
 
-- 
cgit v1.2.1