bug: DatabaseDumper loads entire SQL dump into RAM — OOM on large sites #74

New Issue

2026-06-21T23:01:08Z

jmiller commented

2026-06-21 23:01:08 +00:00

Severity: CRITICAL

DatabaseDumper::dump() returns the entire SQL dump as a single string. BackupEngine::run() then passes it to $archiver->addFromString(). A 500 MB database allocates the dump 2-3x in RAM (array + implode + ZipArchive buffer), exceeding the 512 MB memory limit.

SteppedBackupEngine already writes to a temp file incrementally — the synchronous engine should do the same.

Fix

Write the dump to a temp .sql file and use $archiver->addFile() instead of addFromString().

Files

src/Engine/BackupEngine.php:136-138
src/Engine/DatabaseDumper.php — add streaming/file-based dump method

## Severity: CRITICAL `DatabaseDumper::dump()` returns the entire SQL dump as a single string. `BackupEngine::run()` then passes it to `$archiver->addFromString()`. A 500 MB database allocates the dump 2-3x in RAM (array + implode + ZipArchive buffer), exceeding the 512 MB memory limit. `SteppedBackupEngine` already writes to a temp file incrementally — the synchronous engine should do the same. ## Fix Write the dump to a temp `.sql` file and use `$archiver->addFile()` instead of `addFromString()`. ## Files - `src/Engine/BackupEngine.php:136-138` - `src/Engine/DatabaseDumper.php` — add streaming/file-based dump method

jmiller added the component: engine label 2026-06-21 23:01:08 +00:00

jmiller referenced this issue

2026-06-21 23:04:13 +00:00

test: Deep dive audit — verify and fix all findings #81

jmiller referenced this issue from a commit

2026-06-21 23:17:16 +00:00

fix: remaining audit findings — OOM, security, error handling (#81)

jmiller referenced a pull request that will close this issue

2026-06-21 23:17:31 +00:00

fix: Remaining audit findings — OOM, security, error handling (#81) #85

jmiller closed this issue

2026-06-21 23:17:58 +00:00