Roave / SecurityAdvisories

:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
MIT License
2.72k stars 106 forks source link

Memory Exhaustion #32

Closed javabudd closed 7 years ago

javabudd commented 7 years ago

After adding "roave/security-advisories": "dev-master" and running composer update I hit a memory exhaustion error in PHP. I have 1 gig set as my memory_limit.

Fatal error: Allowed memory size of 1073741824 bytes exhausted (tried to allocate 4096 bytes) in phar:///usr/local/bin/composer/src/Composer/DependencyResolver/RuleWatchGraph.php on line 52

There is no documentation about memory consumption so I'm wondering if other people have ran into this issue, or if it's my system?

edit Upping the PHP memory_limit to 2GB has resolved the issue.

Ocramius commented 7 years ago

Seems related to the size of the graph that you have already in your composer.json. Do you have an example? The package itself doesn't do anything but provide an exclusion policy via the composer.json "conflicts" key.

javabudd commented 7 years ago

Here are my package dependencies:

"require": {
    "beberlei/DoctrineExtensions": "^1.0.11",
    "doctrine/doctrine-orm-module": "^1.1.0",
    "doctrine/migrations": "^1.3.0",
    "firebase/php-jwt": "~3.0",
    "gedmo/doctrine-extensions": "^2.4.20",
    "h4cc/wkhtmltopdf-amd64": "^0.12.3",
    "knplabs/knp-snappy": "^0.4.3",
    "mikehaertl/phpwkhtmltopdf": "^2.2.0",
    "obg/PROPRIETARY": "~0.1",
    "obg/PROPRIETARY": "~0.1",
    "obg/PROPRIETARY": "~0.1",
    "obg/PROPRIETARY": "~0.2",
    "obg/PROPRIETARY": "~0.1",
    "obg/PROPRIETARY": "~0.1",
    "obg/PROPRIETARY": "~0.1",
    "obg/PROPRIETARY": "^0.2",
    "phayes/geophp": "^1.2",
    "php": ">=7.0",
    "php-amqplib/php-amqplib": "2.5.*",
    "roave/security-advisories": "dev-master",
    "stripe/stripe-php": "3.*",
    "willdurand/geocoder": "~3.3",
    "zendframework/zendframework": "^3.0.0",
    "zendframework/zend-filter": "^2.7.1",
    "zendframework/zend-stdlib": "^3.0.0",
    "zendframework/zend-validator": "^2.8.1",
    "zfcampus/zf-apigility": "^1.3.0",
    "zfcampus/zf-apigility-doctrine": "^2.1.0",
    "zfcampus/zf-configuration": "^1.2.1",
    "zfcampus/zf-content-validation": "^1.3.5",
    "zfcampus/zf-doctrine-querybuilder": "^1.5.0",
    "zfcampus/zf-hal": "^1.4.2"
  },
  "require-dev": {
    "codeception/codeception": "2.2.6",
    "codeception/robo-paracept": "^0.2.0",
    "flow/jsonpath": "^0.3.1",
    "league/factory-muffin": "~3.0",
    "league/factory-muffin-faker": "~2.0",
    "phpunit/phpunit": "^5.6.2",
    "phpunit/php-code-coverage": "^4.0.1",
    "raveren/kint": "^1.0",
    "squizlabs/php_codesniffer": "^2.5.1",
    "zendframework/zend-developer-tools": "^1.1.0"
  }

It doesn't seem to be that large a set of dependencies relative to other applications I've worked on. I can do some deeper analysis on my end if that helps.

javabudd commented 7 years ago

I recall having issues with a composer update prior to this happening, so I ran a composer clear-cache. Since composer has to rebuild the cache the next time over and I've added this new package with a big list of exclusions, I can see the possibility of a memory exhaustion. I'll test this theory and report back.

Ocramius commented 7 years ago

If there's a memory issue caused by just the list of exclusions, then it's probably going to end up being a composer issue. A memory profile can expose which composer SAT solver is actually eating up all of your available ram...

javabudd commented 7 years ago

I'm not able to replicate the issue now :/ (working with 512M). I'll keep poking around and run a memory profile if I can replicate, feel free to close this out.