From ff6c9e2726ab724707999ed651d1a414336665f2 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Fri, 30 Nov 2012 14:48:51 +0800
Subject: [PATCH] Fixed bug #63377 (Segfault on output buffer)

---
 NEWS                       |  2 ++
 main/output.c              |  2 +-
 tests/output/bug63377.phpt | 58 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+), 1 deletion(-)
 create mode 100644 tests/output/bug63377.phpt

diff --git a/NEWS b/NEWS
index 93989fb73cf7c..5022c763c35cb 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #63451 (config.guess file does not have AIX 7 defined, 
     shared objects are not created). (kemcline at au1 dot ibm dot com)
+  . Fixed bug #63377 (Segfault on output buffer).
+    (miau dot jp at gmail dot com, Laruence)
 
 - Apache2 Handler SAPI:
   . Enabled Apache 2.4 configure option for Windows (Pierre, Anatoliy)
diff --git a/main/output.c b/main/output.c
index 5a7ed7b1a2338..a9ac0397c34f6 100644
--- a/main/output.c
+++ b/main/output.c
@@ -607,7 +607,7 @@ PHPAPI int php_ob_handler_used(char *handler_name TSRMLS_DC)
 static inline void php_ob_append(const char *text, uint text_length TSRMLS_DC)
 {
 	char *target;
-	int original_ob_text_length;
+	uint original_ob_text_length;
 
 	original_ob_text_length=OG(active_ob_buffer).text_length;
 
diff --git a/tests/output/bug63377.phpt b/tests/output/bug63377.phpt
new file mode 100644
index 0000000000000..75e0af90bc898
--- /dev/null
+++ b/tests/output/bug63377.phpt
@@ -0,0 +1,58 @@
+--TEST--
+Bug #63377 (Segfault on output buffer > 2GB)
+--SKIPF--
+<?php
+$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
+if ($zend_mm_enabled === "0") {
+    die("skip Zend MM disabled");
+}
+
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+// check the available memory
+if (PHP_OS == 'Linux') {
+  $lines = file('/proc/meminfo');
+  $infos = array();
+  foreach ($lines as $line) {
+    $tmp = explode(":", $line);
+    $index = strtolower($tmp[0]);
+    $value = (int)ltrim($tmp[1], " ")*1024;
+    $infos[$index] = $value;
+  }
+  $freeMemory = $infos['memfree']+$infos['buffers']+$infos['cached'];
+  if ($freeMemory < 2100*1024*1024) {
+    die('skip Not enough memory.');
+  }
+}
+elseif (PHP_OS == 'FreeBSD') {
+  $lines = explode("\n",`sysctl -a`);
+  $infos = array();
+  foreach ($lines as $line) {
+    if(!$line){
+      continue;
+    }
+    $tmp = explode(":", $line);
+    $index = strtolower($tmp[0]);
+    $value = trim($tmp[1], " ");
+    $infos[$index] = $value;
+  }
+  $freeMemory = ($infos['vm.stats.vm.v_inactive_count']*$infos['hw.pagesize'])
+                +($infos['vm.stats.vm.v_cache_count']*$infos['hw.pagesize'])
+                +($infos['vm.stats.vm.v_free_count']*$infos['hw.pagesize']);
+  if ($freeMemory < 2100*1024*1024) {
+    die('skip Not enough memory.');
+  }
+}
+?>
+--FILE--
+<?php
+ini_set('memory_limit', '3072M');
+
+ob_start();
+for ($i = 0; $i < 22; $i++)  {
+        echo str_repeat('a', 100 * 1024 * 1024);
+}
+ob_end_clean();
+echo "okey";
+?>
+--EXPECTF--
+okey