Skip to content

Commit d49e419

Browse files
arnaud-lbarnaud-lb
committed
Merge branch 'PHP-8.2'
* PHP-8.2: Fix concurrent testing [ci skip] NEWS Fix GH-10370: File corruption in _php_stream_copy_to_stream_ex when using copy_file_range (#10440)
2 parents 8a267b0 + 10f2378 commit d49e419

File tree

8 files changed

+168
-4
lines changed

8 files changed

+168
-4
lines changed

‎ext/zend_test/php_test.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,7 @@ ZEND_BEGIN_MODULE_GLOBALS(zend_test)
5353
int replace_zend_execute_ex;
5454
int register_passes;
5555
bool print_stderr_mshutdown;
56+
zend_long limit_copy_file_range;
5657
zend_test_fiber *active_fiber;
5758
zend_long quantity_value;
5859
zend_string *str_test;

‎ext/zend_test/test.c

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -721,6 +721,9 @@ PHP_INI_BEGIN()
721721
STD_PHP_INI_BOOLEAN("zend_test.replace_zend_execute_ex", "0", PHP_INI_SYSTEM, OnUpdateBool, replace_zend_execute_ex, zend_zend_test_globals, zend_test_globals)
722722
STD_PHP_INI_BOOLEAN("zend_test.register_passes", "0", PHP_INI_SYSTEM, OnUpdateBool, register_passes, zend_zend_test_globals, zend_test_globals)
723723
STD_PHP_INI_BOOLEAN("zend_test.print_stderr_mshutdown", "0", PHP_INI_SYSTEM, OnUpdateBool, print_stderr_mshutdown, zend_zend_test_globals, zend_test_globals)
724+
#ifdef HAVE_COPY_FILE_RANGE
725+
STD_PHP_INI_ENTRY("zend_test.limit_copy_file_range", "-1", PHP_INI_ALL, OnUpdateLong, limit_copy_file_range, zend_zend_test_globals, zend_test_globals)
726+
#endif
724727
STD_PHP_INI_ENTRY("zend_test.quantity_value", "0", PHP_INI_ALL, OnUpdateLong, quantity_value, zend_zend_test_globals, zend_test_globals)
725728
STD_PHP_INI_ENTRY("zend_test.str_test", "", PHP_INI_ALL, OnUpdateStr, str_test, zend_zend_test_globals, zend_test_globals)
726729
STD_PHP_INI_ENTRY("zend_test.not_empty_str_test", "val", PHP_INI_ALL, OnUpdateStrNotEmpty, not_empty_str_test, zend_zend_test_globals, zend_test_globals)
@@ -952,3 +955,17 @@ PHP_ZEND_TEST_API void bug_gh9090_void_int_char_var(int i, char *fmt, ...) {
952955

953956
va_end(args);
954957
}
958+
959+
#ifdef HAVE_COPY_FILE_RANGE
960+
/**
961+
* This function allows us to simulate early return of copy_file_range by setting the limit_copy_file_range ini setting.
962+
*/
963+
PHP_ZEND_TEST_API ssize_t copy_file_range(int fd_in, off64_t *off_in, int fd_out, off64_t *off_out, size_t len, unsigned int flags)
964+
{
965+
ssize_t (*original_copy_file_range)(int, off64_t *, int, off64_t *, size_t, unsigned int) = dlsym(RTLD_NEXT, "copy_file_range");
966+
if (ZT_G(limit_copy_file_range) >= Z_L(0)) {
967+
len = ZT_G(limit_copy_file_range);
968+
}
969+
return original_copy_file_range(fd_in, off_in, fd_out, off_out, len, flags);
970+
}
971+
#endif

‎ext/zend_test/tests/gh10370.tar

11.5 KB
Binary file not shown.

‎ext/zend_test/tests/gh10370_1.phpt

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
--TEST--
2+
GH-10370: File corruption in _php_stream_copy_to_stream_ex when using copy_file_range - partial copy
3+
--EXTENSIONS--
4+
zend_test
5+
phar
6+
--SKIPIF--
7+
<?php
8+
if (PHP_OS != 'Linux') {
9+
die('skip For Linux only');
10+
}
11+
?>
12+
--INI--
13+
zend_test.limit_copy_file_range=3584
14+
--FILE--
15+
<?php
16+
/* Note: the value 3584 is chosen so that the mmap in _php_stream_copy_to_stream_ex() will mmap
17+
* at an offset of a multiple of 4096, which is the standard page size in most Linux systems. */
18+
$archive = new PharData(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370.tar');
19+
var_dump($archive->extractTo(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_001', ['testfile']));
20+
var_dump(sha1_file(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_001' . DIRECTORY_SEPARATOR . 'testfile'));
21+
?>
22+
--EXPECT--
23+
bool(true)
24+
string(40) "a723ae4ec7eababff73ca961a771b794be6388d2"
25+
--CLEAN--
26+
<?php
27+
@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_001' . DIRECTORY_SEPARATOR . 'testfile');
28+
@rmdir(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_001');
29+
?>

‎ext/zend_test/tests/gh10370_2.phpt

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
--TEST--
2+
GH-10370: File corruption in _php_stream_copy_to_stream_ex when using copy_file_range - unlimited copy
3+
--EXTENSIONS--
4+
zend_test
5+
--SKIPIF--
6+
<?php
7+
if (PHP_OS != 'Linux') {
8+
die('skip For Linux only');
9+
}
10+
?>
11+
--INI--
12+
zend_test.limit_copy_file_range=4096
13+
--FILE--
14+
<?php
15+
/* Note: the value 4096 is chosen so that the mmap in _php_stream_copy_to_stream_ex() will mmap
16+
* at an offset of a multiple of 4096, which is the standard page size in most Linux systems. */
17+
$input_file = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370.tar', 'r');
18+
file_put_contents(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_002_out.tar', $input_file);
19+
fclose($input_file);
20+
21+
var_dump(sha1_file(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370.tar'));
22+
var_dump(sha1_file(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_002_out.tar'));
23+
?>
24+
--EXPECT--
25+
string(40) "edcad8cd6c276f5e318c826ad77a5604d6a6e93d"
26+
string(40) "edcad8cd6c276f5e318c826ad77a5604d6a6e93d"
27+
--CLEAN--
28+
<?php
29+
@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_002_out.tar');
30+
?>

‎ext/zend_test/tests/gh10370_3.phpt

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
--TEST--
2+
GH-10370: File corruption in _php_stream_copy_to_stream_ex when using copy_file_range - partial copy using stream_copy_to_stream
3+
--EXTENSIONS--
4+
zend_test
5+
--SKIPIF--
6+
<?php
7+
if (PHP_OS != 'Linux') {
8+
die('skip For Linux only');
9+
}
10+
?>
11+
--INI--
12+
zend_test.limit_copy_file_range=3584
13+
--FILE--
14+
<?php
15+
/* Note: the value 3584 is chosen so that the mmap in _php_stream_copy_to_stream_ex() will mmap
16+
* at an offset of a multiple of 4096, which is the standard page size in most Linux systems. */
17+
mkdir(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_003');
18+
19+
$input = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370.tar', 'r');
20+
$output = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_003' . DIRECTORY_SEPARATOR . 'testfile', 'w');
21+
22+
var_dump(stream_copy_to_stream($input, $output, 10240, 0x200));
23+
24+
fclose($input);
25+
fclose($output);
26+
27+
var_dump(sha1_file(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_003' . DIRECTORY_SEPARATOR . 'testfile'));
28+
?>
29+
--EXPECT--
30+
int(10240)
31+
string(40) "a723ae4ec7eababff73ca961a771b794be6388d2"
32+
--CLEAN--
33+
<?php
34+
@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_003' . DIRECTORY_SEPARATOR . 'testfile');
35+
@rmdir(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_003');
36+
?>

‎ext/zend_test/tests/gh10370_4.phpt

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
--TEST--
2+
GH-10370: File corruption in _php_stream_copy_to_stream_ex when using copy_file_range - unlimited copy using stream_copy_to_stream
3+
--EXTENSIONS--
4+
zend_test
5+
--SKIPIF--
6+
<?php
7+
if (PHP_OS != 'Linux') {
8+
die('skip For Linux only');
9+
}
10+
?>
11+
--INI--
12+
zend_test.limit_copy_file_range=4096
13+
--FILE--
14+
<?php
15+
/* Note: the value 4096 is chosen so that the mmap in _php_stream_copy_to_stream_ex() will mmap
16+
* at an offset of a multiple of 4096, which is the standard page size in most Linux systems. */
17+
18+
$input = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370.tar', 'r');
19+
$output = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_004_out.tar', 'w');
20+
21+
var_dump(stream_copy_to_stream($input, $output));
22+
23+
fclose($input);
24+
fclose($output);
25+
26+
var_dump(sha1_file(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370.tar'));
27+
var_dump(sha1_file(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_004_out.tar'));
28+
?>
29+
--EXPECT--
30+
int(11776)
31+
string(40) "edcad8cd6c276f5e318c826ad77a5604d6a6e93d"
32+
string(40) "edcad8cd6c276f5e318c826ad77a5604d6a6e93d"
33+
--CLEAN--
34+
<?php
35+
@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'gh10370_004_out.tar');
36+
?>

‎main/streams/streams.c

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1635,8 +1635,21 @@ PHPAPI zend_result _php_stream_copy_to_stream_ex(php_stream *src, php_stream *de
16351635
char *p;
16361636

16371637
do {
1638-
size_t chunk_size = (maxlen == 0 || maxlen > PHP_STREAM_MMAP_MAX) ? PHP_STREAM_MMAP_MAX : maxlen;
1639-
size_t mapped;
1638+
/* We must not modify maxlen here, because otherwise the file copy fallback below can fail */
1639+
size_t chunk_size, must_read, mapped;
1640+
if (maxlen == 0) {
1641+
/* Unlimited read */
1642+
must_read = chunk_size = PHP_STREAM_MMAP_MAX;
1643+
} else {
1644+
must_read = maxlen - haveread;
1645+
if (must_read >= PHP_STREAM_MMAP_MAX) {
1646+
chunk_size = PHP_STREAM_MMAP_MAX;
1647+
} else {
1648+
/* In case the length we still have to read from the file could be smaller than the file size,
1649+
* chunk_size must not get bigger the size we're trying to read. */
1650+
chunk_size = must_read;
1651+
}
1652+
}
16401653

16411654
p = php_stream_mmap_range(src, php_stream_tell(src), chunk_size, PHP_STREAM_MAP_MODE_SHARED_READONLY, &mapped);
16421655

@@ -1651,6 +1664,7 @@ PHPAPI zend_result _php_stream_copy_to_stream_ex(php_stream *src, php_stream *de
16511664
didwrite = php_stream_write(dest, p, mapped);
16521665
if (didwrite < 0) {
16531666
*len = haveread;
1667+
php_stream_mmap_unmap(src);
16541668
return FAILURE;
16551669
}
16561670

@@ -1667,9 +1681,10 @@ PHPAPI zend_result _php_stream_copy_to_stream_ex(php_stream *src, php_stream *de
16671681
if (mapped < chunk_size) {
16681682
return SUCCESS;
16691683
}
1684+
/* If we're not reading as much as possible, so a bounded read */
16701685
if (maxlen != 0) {
1671-
maxlen -= mapped;
1672-
if (maxlen == 0) {
1686+
must_read -= mapped;
1687+
if (must_read == 0) {
16731688
return SUCCESS;
16741689
}
16751690
}

0 commit comments

Comments
 (0)