From 7634f88a22e0d416f6c473fb2ae6b1647ce5f483 Mon Sep 17 00:00:00 2001
From: Albert Casademont <albertcasademont@gmail.com>
Date: Tue, 23 Jul 2019 14:03:06 +0200
Subject: [PATCH] fix #78326 improper memory deallocation on
 stream_get_contents() with fixed length buffer

---
 ext/standard/tests/streams/bug78326.phpt   | 18 ++++++++++++++++++
 ext/standard/tests/streams/bug78326_1.phpt | 10 ++++++++++
 main/streams/streams.c                     |  7 ++++++-
 3 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/streams/bug78326.phpt
 create mode 100644 ext/standard/tests/streams/bug78326_1.phpt

diff --git a/ext/standard/tests/streams/bug78326.phpt b/ext/standard/tests/streams/bug78326.phpt
new file mode 100644
index 0000000000000..ca27b05f62a26
--- /dev/null
+++ b/ext/standard/tests/streams/bug78326.phpt
@@ -0,0 +1,18 @@
+--TEST--
+memory allocation on stream_get_contents()
+--INI--
+memory_limit=32M
+--FILE--
+<?php
+$f = tmpfile();
+fwrite($f, '.');
+
+$chunks = array();
+for ($i = 0; $i < 1000; ++$i) {
+    rewind($f);
+    $chunks[] = stream_get_contents($f, 1000000);
+}
+var_dump(count($chunks));
+?>
+--EXPECT--
+int(1000)
diff --git a/ext/standard/tests/streams/bug78326_1.phpt b/ext/standard/tests/streams/bug78326_1.phpt
new file mode 100644
index 0000000000000..4a6c25df314e3
--- /dev/null
+++ b/ext/standard/tests/streams/bug78326_1.phpt
@@ -0,0 +1,10 @@
+--TEST--
+proper string length on stream_get_contents()
+--FILE--
+<?php
+$f = fopen('php://memory', 'rw');
+fwrite($f, str_repeat('X', 1000));
+fseek($f, 0); 
+var_dump(strlen(stream_get_contents($f, 1024)));
+--EXPECT--
+int(1000)
diff --git a/main/streams/streams.c b/main/streams/streams.c
index 9daae574337a1..399ec29810dcc 100644
--- a/main/streams/streams.c
+++ b/main/streams/streams.c
@@ -1418,8 +1418,13 @@ PHPAPI zend_string *_php_stream_copy_to_mem(php_stream *src, size_t maxlen, int
 			ptr += ret;
 		}
 		if (len) {
-			*ptr = '\0';
 			ZSTR_LEN(result) = len;
+			ZSTR_VAL(result)[len] = '\0';
+
+			/* Only truncate if the savings are large enough */
+			if (len < maxlen / 2) {
+				result = zend_string_truncate(result, len, persistent);
+			}
 		} else {
 			zend_string_free(result);
 			result = NULL;