Fix GH-24492 (partial): route caller-sized string builders through the fallible allocator

ext/standard/math.c

@@ -1170,7 +1170,11 @@ PHPAPI zend_string *_php_math_number_format_ex(double d, int dec, const char *de
 	if (is_negative) {
 		reslen++;
 	}
-	res = zend_string_alloc(reslen, 0);
+	res = zend_string_falloc(reslen, 0, true);
+	if (UNEXPECTED(res == NULL)) {
+		zend_string_release_ex(tmpbuf, 0);
+		return NULL;
+	}
 
 	s = ZSTR_VAL(tmpbuf) + ZSTR_LEN(tmpbuf) - 1;
 	t = ZSTR_VAL(res) + reslen;
@@ -1300,7 +1304,11 @@ PHPAPI zend_string *_php_math_number_format_long(zend_long num, zend_long dec, c
 		}
 	}
 
-	res = zend_string_alloc(reslen, 0);
+	res = zend_string_falloc(reslen, 0, true);
+	if (UNEXPECTED(res == NULL)) {
+		zend_string_release_ex(tmpbuf, 0);
+		return NULL;
+	}
 
 	s = ZSTR_VAL(tmpbuf) + ZSTR_LEN(tmpbuf) - 1;
 	t = ZSTR_VAL(res) + reslen;
@@ -1368,9 +1376,14 @@ PHP_FUNCTION(number_format)
 	}
 
 	switch (Z_TYPE_P(num)) {
-		case IS_LONG:
-			RETURN_STR(_php_math_number_format_long(Z_LVAL_P(num), dec, dec_point, dec_point_len, thousand_sep, thousand_sep_len));
+		case IS_LONG: {
+			zend_string *formatted = _php_math_number_format_long(Z_LVAL_P(num), dec, dec_point, dec_point_len, thousand_sep, thousand_sep_len);
+			if (UNEXPECTED(formatted == NULL)) {
+				RETURN_OOM();
+			}
+			RETURN_STR(formatted);
 			break;
+		}
 
 		case IS_DOUBLE:
 			// double values of >= 2^52 can not have fractional digits anymore
@@ -1379,7 +1392,13 @@ PHP_FUNCTION(number_format)
 				(Z_DVAL_P(num) >= 4503599627370496.0 || Z_DVAL_P(num) <= -4503599627370496.0)
 				&& ZEND_DOUBLE_FITS_LONG(Z_DVAL_P(num))
 			)) {
-				RETURN_STR(_php_math_number_format_long((zend_long)Z_DVAL_P(num), dec, dec_point, dec_point_len, thousand_sep, thousand_sep_len));
+				{
+					zend_string *formatted = _php_math_number_format_long((zend_long)Z_DVAL_P(num), dec, dec_point, dec_point_len, thousand_sep, thousand_sep_len);
+					if (UNEXPECTED(formatted == NULL)) {
+						RETURN_OOM();
+					}
+					RETURN_STR(formatted);
+				}
                 break;
 			}
 
@@ -1388,7 +1407,13 @@ PHP_FUNCTION(number_format)
 			} else {
 				dec_int = ZEND_LONG_INT_UDFL(dec) ? INT_MIN : (int)dec;
 			}
-			RETURN_STR(_php_math_number_format_ex(Z_DVAL_P(num), dec_int, dec_point, dec_point_len, thousand_sep, thousand_sep_len));
+			{
+				zend_string *formatted = _php_math_number_format_ex(Z_DVAL_P(num), dec_int, dec_point, dec_point_len, thousand_sep, thousand_sep_len);
+				if (UNEXPECTED(formatted == NULL)) {
+					RETURN_OOM();
+				}
+				RETURN_STR(formatted);
+			}
 			break;
 
 		EMPTY_SWITCH_DEFAULT_CASE()

ext/standard/pack.c

@@ -218,8 +218,15 @@ PHP_FUNCTION(pack)
 	ZEND_PARSE_PARAMETERS_END();
 
 	/* We have a maximum of <formatlen> format codes to deal with */
-	formatcodes = safe_emalloc(formatlen, sizeof(*formatcodes), 0);
-	formatargs = safe_emalloc(formatlen, sizeof(*formatargs), 0);
+	formatcodes = safe_femalloc(formatlen, sizeof(*formatcodes), 0, true);
+	if (UNEXPECTED(formatcodes == NULL)) {
+		RETURN_OOM();
+	}
+	formatargs = safe_femalloc(formatlen, sizeof(*formatargs), 0, true);
+	if (UNEXPECTED(formatargs == NULL)) {
+		efree(formatcodes);
+		RETURN_OOM();
+	}
 	currentarg = 0;
 
 	/* Preprocess format into formatcodes and formatargs */
@@ -428,7 +435,12 @@ PHP_FUNCTION(pack)
 		}
 	}
 
-	output = zend_string_alloc(outputsize, 0);
+	output = zend_string_falloc(outputsize, 0, true);
+	if (UNEXPECTED(output == NULL)) {
+		efree(formatcodes);
+		efree(formatargs);
+		RETURN_OOM();
+	}
 	outputpos = 0;
 	currentarg = 0;
 

ext/standard/quot_print.c

@@ -144,7 +144,10 @@ PHPAPI zend_string *php_quot_print_encode(const unsigned char *str, size_t lengt
 	const char *hex = "0123456789ABCDEF";
 	zend_string *ret;
 
-	ret = zend_string_safe_alloc(3, (length + (((3 * length)/(PHP_QPRINT_MAXL-9)) + 1)), 0, 0);
+	ret = zend_string_safe_falloc(3, (length + (((3 * length)/(PHP_QPRINT_MAXL-9)) + 1)), 0, 0, true);
+	if (UNEXPECTED(ret == NULL)) {
+		return NULL;
+	}
 	d = (unsigned char*)ZSTR_VAL(ret);
 
 	while (length--) {
@@ -267,6 +270,9 @@ PHP_FUNCTION(quoted_printable_encode)
 	}
 
 	new_str = php_quot_print_encode((unsigned char *)ZSTR_VAL(str), ZSTR_LEN(str));
+	if (UNEXPECTED(new_str == NULL)) {
+		RETURN_OOM();
+	}
 	RETURN_STR(new_str);
 }
 /* }}} */

ext/standard/string.c

@@ -65,7 +65,10 @@ static zend_string *php_bin2hex(const unsigned char *old, const size_t oldlen)
 	zend_string *result;
 	size_t i, j;
 
-	result = zend_string_safe_alloc(oldlen, 2 * sizeof(char), 0, 0);
+	result = zend_string_safe_falloc(oldlen, 2 * sizeof(char), 0, 0, true);
+	if (UNEXPECTED(result == NULL)) {
+		return NULL;
+	}
 
 	for (i = j = 0; i < oldlen; i++) {
 		ZSTR_VAL(result)[j++] = hexconvtab[old[i] >> 4];
@@ -165,6 +168,9 @@ PHP_FUNCTION(bin2hex)
 	ZEND_PARSE_PARAMETERS_END();
 
 	result = php_bin2hex((unsigned char *)ZSTR_VAL(data), ZSTR_LEN(data));
+	if (UNEXPECTED(result == NULL)) {
+		RETURN_OOM();
+	}
 
 	RETURN_STR(result);
 }
@@ -6390,7 +6396,10 @@ static zend_string *php_utf8_encode(const char *s, size_t len)
 	zend_string *str;
 	unsigned char c;
 
-	str = zend_string_safe_alloc(len, 2, 0, 0);
+	str = zend_string_safe_falloc(len, 2, 0, 0, true);
+	if (UNEXPECTED(str == NULL)) {
+		return NULL;
+	}
 	ZSTR_LEN(str) = 0;
 	while (pos > 0) {
 		/* The lower 256 codepoints of Unicode are identical to Latin-1,
@@ -6454,7 +6463,11 @@ PHP_FUNCTION(utf8_encode)
 		Z_PARAM_STRING(arg, arg_len)
 	ZEND_PARSE_PARAMETERS_END();
 
-	RETURN_STR(php_utf8_encode(arg, arg_len));
+	zend_string *result = php_utf8_encode(arg, arg_len);
+	if (UNEXPECTED(result == NULL)) {
+		RETURN_OOM();
+	}
+	RETURN_STR(result);
 }
 /* }}} */
 

ext/standard/tests/math/gh24492_number_format.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: number_format allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+number_format(1.0, 100000000);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_bin2hex.phpt

@@ -0,0 +1,14 @@
+--TEST--
+GH-24492: bin2hex allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+$s = str_repeat("a", 10 * 1024 * 1024);
+bin2hex($s);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 4
+shutdown

ext/standard/tests/strings/gh24492_convert_uuencode.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: convert_uuencode allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+convert_uuencode(str_repeat("a", 13 * 1024 * 1024));
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_fprintf.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: fprintf allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+fprintf(STDOUT, "%40000000s", "");
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_pack.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: pack allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+pack("x40000000");
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_pack_absolute.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: pack_absolute allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+pack("@40000000");
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_pack_format.phpt

@@ -0,0 +1,14 @@
+--TEST--
+GH-24492: pack_format allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+$format = str_repeat("x", 8 * 1024 * 1024);
+pack($format);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 4
+shutdown

ext/standard/tests/strings/gh24492_printf.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: printf allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+printf("%40000000s", "");
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_quoted_printable_encode.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: quoted_printable_encode allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+quoted_printable_encode(str_repeat("\xff", 10 * 1024 * 1024));
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_sprintf.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: sprintf allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+sprintf("%40000000s", "");
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_sprintf_dynamic.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: sprintf_dynamic allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+sprintf("%*s", 40000000, "");
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_sprintf_float.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: sprintf_float allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+sprintf("%40000000F", 1.0);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_sprintf_integer.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: sprintf_integer allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+sprintf("%40000000d", 1);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_utf8_encode.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: utf8_encode allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+@utf8_encode(str_repeat("\xff", 12 * 1024 * 1024));
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_vfprintf.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: vfprintf allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+vfprintf(STDOUT, "%40000000s", [""]);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown

ext/standard/tests/strings/gh24492_vprintf.phpt

@@ -0,0 +1,13 @@
+--TEST--
+GH-24492: vprintf allocation failure must not reach the hard memory limit
+--INI--
+memory_limit=16M
+memory_hard_limit_percent=200
+--FILE--
+<?php
+register_shutdown_function(static function () { echo "shutdown\n"; });
+vprintf("%40000000s", [""]);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 3
+shutdown