Oversized box-style attribute objects exhaust memory during CSS generation

Summary

Frontend CSS generation can exhaust the PHP memory limit when a supported block contains an oversized box-style attribute object.

Expected behavior: CSS generation handles box-style attributes within the request's available memory.

Actual behavior: the request processes and copies all entries in an oversized object even though the rendered CSS uses four box sides, leading to a fatal memory-exhaustion error.

Impact: affected frontend page requests can fail instead of rendering.

Customer context

• Product / area: Otter Blocks frontend CSS generation
• Version: 3.2.4
• Environment: WordPress 7.1; PHP 8.1.33; 128 MB PHP memory limit
• Integration / third party: None identified
• Reported error / symptom: Allowed memory size of 134217728 bytes exhausted (tried to allocate 65536 bytes)
• Impact: 39 telemetry occurrences across two sites: 32 in Posts pagination padding and 7 in Form input border-width processing.

Reproduction notes

1. Store block content containing either a Posts pagPadding object or Form inputBorderWidth object with many extra entries beyond the directional values.
2. Request a frontend page that reaches Otter dynamic CSS generation under a 128 MB PHP memory limit.
3. The reported production paths terminate with a memory-exhaustion fatal at the respective formatter call site.

The exact production content was not captured. The oversized-object input is inferred from the released formatter's unbounded array processing and the two reported call sites.

Diagnosis

Conclusion

Released Otter 3.2.4 source accepts arbitrary-size arrays in its shared box-value formatter, then creates full transformed and merged copies before rendering only top, right, bottom, and left. Both telemetry locations call this formatter from frontend CSS generation, providing a direct code path consistent with the reported allocation failures.

Where this likely occurs

• inc/css/class-css-utility.php — CSS_Utility::box_values() lines 329-352 transforms every supplied array entry with array_map() and creates another merged array; CSS_Utility::render_box() lines 413-418 consumes only the four directional keys.
• inc/css/blocks/class-posts-css.php — Posts_CSS::render_css() lines 392-397 routes the pagPadding attribute from the first fingerprint to CSS_Utility::box_values().
• inc/css/blocks/class-form-css.php — Form_CSS::render_css() lines 85-102 routes array-valued inputBorderWidth from the third fingerprint to CSS_Utility::box_values().
• inc/class-base-css.php — Base_CSS::get_blocks_css() lines 261-275 parses persisted post blocks; Base_CSS::cycle_through_static_blocks() lines 338-365 dispatches their CSS renderers during traversal.
• Tagged source at v3.2.4 contains the same formatter and both call sites. v3.2.4..v3.2.5 changes only an animation compatibility guard among the inspected affected paths, so no regression boundary is established.
• Open issue #2961 was read. It concerns accumulation from repeated Base_CSS renderer registrations at a different source location and does not document oversized box-attribute processing.

Engineering notes

The two crash sites are separate block attributes but reach the same shared formatter and exhibit the same allocation behavior. Normal editor values are expected to contain four directional values; the reported payloads were not captured, so their exact size and origin remain unknown. The failure is outside the Themeisle SDK according to telemetry, and inspected code is in the Otter Blocks repository.

Test coverage status

tests/test-css.php lines 202-222 covers string input and normal render_box() output. No relevant coverage was found during inspection for oversized arrays, extra box-object keys, or memory-bounded CSS generation through the Posts and Form renderers.

What to verify or explore next

• Reproduce frontend CSS generation with a persisted Posts pagPadding object containing substantially more than the four directional keys under a 128 MB PHP memory limit.
• Reproduce the Form inputBorderWidth array path with an equivalently oversized object.
• Run the PHP CSS tests, including tests/test-css.php, after adding bounded-input coverage in the relevant test environment.
• Confirm whether content migrations, imports, or third-party block-content writers can create oversized box-style objects in supported workflows.

Unknowns / follow-up

• Telemetry does not include the affected serialized block attributes, complete stacks, or generated CSS size.
• The observed reports establish two affected sites but not the broader prevalence of oversized attribute data.

Confidence

Confidence: 93/100

Two frontend crash fingerprints resolve to the same unbounded box-style attribute processing in released Otter 3.2.4 source. The cron asset-file fingerprint was not confirmed: normal source only includes small generated metadata there, while the affected built artifact and preceding request memory use are unavailable; this is consistent with cumulative memory pressure or an anomalous deployment rather than a demonstrated product defect.

Crash telemetry

Fingerprint af09ac08689a3ad5ac8987ff514cfa6b

Occurrences	32
Distinct sites	1
First seen	2026-09-13 18:28 UTC
Last seen	2026-09-15 23:23 UTC
Crash location	product:inc/css/blocks/class-posts-css.php:395
Request context	frontend
Inside Themeisle SDK	no
Product versions	3.2.4
WP versions	7.1
PHP versions	8.1.33
SDK versions	3.3.61

Fingerprint b2e7e1acd3bb03415c1ed8089501fb83

Occurrences	7
Distinct sites	1
First seen	2026-09-14 03:21 UTC
Last seen	2026-09-15 14:50 UTC
Crash location	product:inc/css/blocks/class-form-css.php:99
Request context	frontend
Inside Themeisle SDK	no
Product versions	3.2.4
WP versions	7.1
PHP versions	8.1.33
SDK versions	3.3.61

---

Source: automated crash report — otter-blocks, fingerprints af09ac08689a3ad5ac8987ff514cfa6b, b2e7e1acd3bb03415c1ed8089501fb83
Generated by bug-report-triage (ID: bug-report-triage_6aaa31036c42b3.47879879)