- Affected version
- 2.3.11
Affected version
XenForo Media Gallery 2.3.11
XenForo 2.3.11
Summary
When a user attaches certain iPhone-generated MOV files to a normal XenForo forum thread, and that forum is configured to mirror attachments into a XenForo Media Gallery category, final thread creation exhausts the PHP memory limit inside:
The attachment upload itself succeeds. Draft autosave also succeeds. The failure occurs when the user submits the thread and the attachment is associated with the thread/mirrored into XFMG.
The browser receives an empty HTTP 500 response, making the Post button appear non-responsive. The thread is not created.
Configuration
The affected forum has:
Observed examples
This occurred independently for two users using iPhone Safari:
Images uploaded during the same thread compositions succeeded. The MOV files also uploaded successfully and remained as unassociated attachments after thread creation failed.
Steps to reproduce
Actual result
The final POST to the forum's post-thread route returns HTTP 500 with no response body. No thread is created.
Apache/PHP-FPM records:
The same fatal was reproduced across five posting attempts involving two different users and two different iPhone MOV files.
The failure does not appear in XenForo's server error log, presumably because PHP exhausts its available memory before XenForo can record the exception. It is present in the Apache/PHP-FPM error log.
Expected result
XFMG should parse and mirror the video without consuming excessive memory.
If the file is malformed or unsupported, XFMG should reject or skip the mirrored video gracefully. It should not exhaust 1 GB of memory or prevent the underlying forum thread from being created.
Additional findings
Sample file
An affected iPhone MOV can be provided privately to XenForo staff for reproduction. I would prefer not to attach the user's fishing video publicly.
Please let me know the preferred private method for supplying the sample and full stack/log details.
XenForo Media Gallery 2.3.11
XenForo 2.3.11
Summary
When a user attaches certain iPhone-generated MOV files to a normal XenForo forum thread, and that forum is configured to mirror attachments into a XenForo Media Gallery category, final thread creation exhausts the PHP memory limit inside:
Code:
src/addons/XFMG/VideoInfo/Preparer.phpThe attachment upload itself succeeds. Draft autosave also succeeds. The failure occurs when the user submits the thread and the attachment is associated with the thread/mirrored into XFMG.
The browser receives an empty HTTP 500 response, making the Post button appear non-responsive. The thread is not created.
Configuration
The affected forum has:
- Mirror attachments to media category enabled
- A valid XFMG destination category selected
- MOV enabled as an accepted video format
- PHP memory_limit set to 1 GB
- XFMG FFmpeg processing disabled
Observed examples
This occurred independently for two users using iPhone Safari:
- Approximately 29.8 MB MOV: two final submission attempts returned HTTP 500
- Approximately 34.9 MB MOV: three final submission attempts returned HTTP 500
Images uploaded during the same thread compositions succeeded. The MOV files also uploaded successfully and remained as unassociated attachments after thread creation failed.
Steps to reproduce
- Configure a normal forum to mirror attachments into an XFMG media category.
- On an iPhone, begin creating a thread in that forum.
- Attach an affected iPhone-generated MOV file.
- Wait for the attachment upload to complete.
- Submit the thread.
Actual result
The final POST to the forum's post-thread route returns HTTP 500 with no response body. No thread is created.
Apache/PHP-FPM records:
Code:
PHP Fatal error: Allowed memory size of 1073741824 bytes exhausted
in /src/addons/XFMG/VideoInfo/Preparer.php on line 215The same fatal was reproduced across five posting attempts involving two different users and two different iPhone MOV files.
The failure does not appear in XenForo's server error log, presumably because PHP exhausts its available memory before XenForo can record the exception. It is present in the Apache/PHP-FPM error log.
Expected result
XFMG should parse and mirror the video without consuming excessive memory.
If the file is malformed or unsupported, XFMG should reject or skip the mirrored video gracefully. It should not exhaust 1 GB of memory or prevent the underlying forum thread from being created.
Additional findings
- The upload and draft-save requests return HTTP 200.
- Only final thread submission fails.
- Disabling attachment mirroring for the forum avoids invoking this XFMG path.
- Increasing the PHP memory limit does not appear to be an appropriate solution because relatively modest 30–35 MB files already exhaust 1 GB.
- The XFMG video Preparer is invoked before any optional FFmpeg/transcoding decision, so enabling FFmpeg alone may not avoid the initial parser failure.
Sample file
An affected iPhone MOV can be provided privately to XenForo staff for reproduction. I would prefer not to attach the user's fishing video publicly.
Please let me know the preferred private method for supplying the sample and full stack/log details.