Skip to content

Fix memory exhaustion when reading corrupted FPT memo files #136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gam6itko merged 9 commits into from
Feb 4, 2026
+26 −63
Merged

Fix memory exhaustion when reading corrupted FPT memo files #136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
df1f46c
Fix memory exhaustion when reading corrupted FPT memo files
panel-sk Jan 28, 2026
14023f1
Update ci.yaml
panel-sk Feb 4, 2026
6d10228
Fix CI was failing due to an outdated upload-artifact
panel-sk Feb 4, 2026
d8d7b4b
ci: fix Code Climate reporter download and update artifacts to v4
panel-sk Feb 4, 2026
3e30fa4
ci: fix Code Climate binary download source
panel-sk Feb 4, 2026
5a6f31c
Bad URL for test reporter
panel-sk Feb 4, 2026
a50dc04
Bad URL for codeclimate tester
panel-sk Feb 4, 2026
f2504e6
Change tests to Codecov
panel-sk Feb 4, 2026
0aa5a7f
Fix codecov test
panel-sk Feb 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 20 additions & 63 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,44 +5,33 @@ on:
push:
branches:
- master
- '*'

jobs:
phpstan:
name: PHPStan
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v2

- uses: php-actions/composer@v5

- uses: actions/checkout@v4
- uses: php-actions/composer@v6
- name: PHPStan
uses: chindit/actions-phpstan@master
with:
# Arguments to add to PHPStan
arguments: 'src/'

phpunit:
name: PHPUnit
runs-on: ubuntu-latest

strategy:
matrix:
php-version:
- 7.1
- 7.2
- 7.3
- 7.4
- 8.0
dependencies:
- highest
php-version: [7.1, 7.2, 7.3, 7.4, 8.0]
dependencies: [highest]
include:
- php-version: 7.1
dependencies: lowest

steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@v4

- name: Install PHP
uses: shivammathur/setup-php@v2
Expand All @@ -52,74 +41,42 @@ jobs:
ini-values: zend.assertions=1

- name: Install dependencies with Composer
uses: ramsey/composer-install@v1
uses: ramsey/composer-install@v2
with:
dependency-versions: ${{ matrix.dependencies }}

- name: Install Codeclimate binary
run: |
curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > cc-test-reporter
chmod +x ./cc-test-reporter

- name: Run Codeclimate before-build
run: ./cc-test-reporter before-build

- name: Run PHPUnit
run: vendor/bin/phpunit --coverage-clover=clover.xml

- name: Upload coverage file artifact
uses: actions/upload-artifact@v2
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
with:
name: ${{ matrix.php-version }}-${{ matrix.dependencies }}
path: clover.xml
token: ${{ secrets.CODECOV_TOKEN }}
files: ./clover.xml
fail_ci_if_error: false

- name: Run Codeclimate format-coverage
run: ./cc-test-reporter format-coverage -o codeclimate.json

- name: Upload coverage file artifact
- name: Upload clover artifact
uses: actions/upload-artifact@v4
with:
name: ${{ matrix.php-version }}-${{ matrix.dependencies }}
path: codeclimate.json


codeclimate-upload:
name: Upload coverage to Codeclimate
runs-on: ubuntu-latest
needs:
- phpunit
env:
CC_TEST_REPORTER_ID: e33b74ed1f59947df361652193b6575db0afc663dcbc73af89a0cf16f2443d24
steps:
- name: Download coverage files
uses: actions/download-artifact@v2
with:
path: coverage
- name: Install Codeclimate binary
run: |
curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > cc-test-reporter
chmod +x ./cc-test-reporter
- run: ./cc-test-reporter sum-coverage coverage/*/codeclimate.json
- run: ./cc-test-reporter upload-coverage

name: clover-${{ matrix.php-version }}-${{ matrix.dependencies }}
path: clover.xml

coveralls-upload:
name: Upload coverage to Coveralls
runs-on: ubuntu-latest
needs:
- phpunit
needs: phpunit
steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@v4

- name: Install PHP
uses: shivammathur/setup-php@v2
with:
php-version: 7.4
coverage: none

- name: Download coverage files
uses: actions/download-artifact@v2
- name: Download all artifacts
uses: actions/download-artifact@v4
with:
path: build/logs

Expand All @@ -129,4 +86,4 @@ jobs:
- name: Upload coverage results to Coveralls
env:
COVERALLS_REPO_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: php-coveralls --coverage_clover=build/logs/*/clover.xml -v
run: php-coveralls --coverage_clover="build/logs/clover-*/clover.xml" -v
6 changes: 6 additions & 0 deletions src/Memo/FoxproMemo.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,12 @@ public function get(int $pointer): ?MemoObject
$info = unpack('N', $this->fp->read(self::BLOCK_TYPE_LENGTH)); //todo figure out type-enums

$memoLength = unpack('N', $this->fp->read(self::BLOCK_LENGTH_LENGTH));

// Safety check: prevent reading corrupted/huge memo fields (max 100MB)
if ($memoLength[1] > 104857600) {
throw new \Exception("Corrupted FPT file: memo field size {$memoLength[1]} bytes exceeds 100MB limit");
}

$result = $this->fp->read($memoLength[1]);

$info = $this->guessDataType($result);
Expand Down