PHP :: Bug #40259 :: ob_start call many times

Bug #40259

ob_start call many times - memory error

Submitted:

2007-01-27 22:13 UTC

Modified:

2007-01-29 11:22 UTC

Votes:	1
Avg. Score:	5.0 ± 0.0
Reproduced:	1 of 1 (100.0%)
Same Version:	1 (100.0%)
Same OS:	0 (0.0%)

From:

tomwys at o2 dot pl

Assigned:

tony2001 (profile)

Status:

Closed

Package:

Output Control

PHP Version:

5.2.0

OS:

Linux

Private report:

CVE-ID:

None

[2007-01-27 22:13 UTC] tomwys at o2 dot pl

Description:
------------
I have tested this code on two machines. I have memory error  or endless loop.

On first machine code fails from $count = 385 on second machine from $count = 1633.

Reproduce code:
---------------
<?php
$count = 385;
for($i = 1; $i < $count; $i ++) {
  ob_start();
  echo $i;
  ob_flush(); 
} 

?>

Expected result:
----------------
123456789101112[etc.]

Actual result:
--------------
First machine:
1[there is endless loop and 100% CPU]

Second machine:
1*** glibc detected *** double free or corruption (top): 0x0000000004c9c370 ***
Aborted

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

[2007-01-27 22:35 UTC] tony2001@php.net

Mike, this looks like a stack overflow to me (note that ob_flush() is used, not ob_end_flush() so we got insane amount of nested buffers).
Do you think you can do something about it?

[2007-01-28 08:15 UTC] mike@php.net

It works even fine here with a count of 50000 if USE_ZEND_ALLOC=0 is set. Maybe a MM failure?

[2007-01-28 10:52 UTC] judas dot iscariote at gmail dot com

I got a segfault with $count = 1633. in 5.2.0

with 5_2 CVS in debug mode I get For exmaple

./sapi/cli/php -dmemory_limit=4M obmess.php
1PHP Fatal error:  Allowed memory size of 4194304 bytes exhausted at /home/cristian/php5/main/output.c:436 (tried to allocate 40961 bytes) in /local/back/home/cristian/php5/obmess.php on line 4
[Sun Jan 28 07:49:34 2007]  Script:  'obmess.php'
---------------------------------------
/home/cristian/php5/main/output.c(316) : Block 0x00EF8FE8 status:
Beginning:      Cached
Freed (invalid)
    Start:      OK
      End:      OK
---------------------------------------
[Sun Jan 28 07:49:34 2007]  Script:  'obmess.php'
---------------------------------------
/home/cristian/php5/main/output.c(319) : Block 0x0102CD58 status:
Beginning:      Freed
    Start:      OK
      End:      OK

[2007-01-29 03:38 UTC] noah at rave dot ca

I have the same problem... Apache starts to user 50% cpu and then crashes giving:

Fatal error: out of dynamic memory in yy_create_buffer() in Unknown on line 0

[2007-01-29 06:06 UTC] noah at rave dot ca

<?php
set_time_limit(0);
$handle = imagecreatefromjpeg('images/large.jpg');
for ($i = 1; $i < 1000; $i++)
{
  ob_start();
  imagejpeg($handle, '', 90);
  $imgdata = ob_get_contents();
  ob_end_clean();
}
?>

Apache keeps running and PHP gives Fatal error: out of dynamic memory in yy_create_buffer() in Unknown on
line 0 with every pageload after so no php pages will load...

[2007-01-29 10:15 UTC] mike@php.net

Re-assigned. I think the original issue has to do with Zend MM.

[2007-01-29 11:22 UTC] dmitry@php.net

Fixed in CVS PHP_5_2. HEAD is not affected.