Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
  Fix #81407: shmop_open won't attach and causes php to crash
This commit is contained in:
Christoph M. Becker 2021-09-02 23:18:29 +02:00
commit 58ad403cec
No known key found for this signature in database
GPG Key ID: D66C9593118BCCB6
3 changed files with 29 additions and 3 deletions

3
NEWS
View File

@ -16,6 +16,9 @@ PHP NEWS
. Fixed bug #81353 (segfault with preloading and statically bound closure).
(Nikita)
- Shmop:
. Fixed bug #81407 (shmop_open won't attach and causes php to crash). (cmb)
- Standard:
. Fixed bug #71542 (disk_total_space does not work with relative paths). (cmb)
. Fixed bug #81400 (Unterminated string in dns_get_record() results). (cmb)

View File

@ -609,16 +609,20 @@ TSRM_API int pclose(FILE *stream)
return termstat;
}/*}}}*/
#define SEGMENT_PREFIX "TSRM_SHM_SEGMENT:"
#define DESCRIPTOR_PREFIX "TSRM_SHM_DESCRIPTOR:"
#define INT_MIN_AS_STRING "-2147483648"
TSRM_API int shmget(key_t key, size_t size, int flags)
{/*{{{*/
shm_pair *shm;
char shm_segment[26], shm_info[29];
char shm_segment[sizeof(SEGMENT_PREFIX INT_MIN_AS_STRING)], shm_info[sizeof(DESCRIPTOR_PREFIX INT_MIN_AS_STRING)];
HANDLE shm_handle = NULL, info_handle = NULL;
BOOL created = FALSE;
if (key != IPC_PRIVATE) {
snprintf(shm_segment, sizeof(shm_segment), "TSRM_SHM_SEGMENT:%d", key);
snprintf(shm_info, sizeof(shm_info), "TSRM_SHM_DESCRIPTOR:%d", key);
snprintf(shm_segment, sizeof(shm_segment), SEGMENT_PREFIX "%d", key);
snprintf(shm_info, sizeof(shm_info), DESCRIPTOR_PREFIX "%d", key);
shm_handle = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_segment);
info_handle = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_info);

View File

@ -0,0 +1,19 @@
--TEST--
Bug #81407 (shmop_open won't attach and causes php to crash)
--SKIPIF--
<?php
if (PHP_OS_FAMILY !== "Windows") die("skip for Windows only");
if (!extension_loaded("shmop")) die("skip shmop extension not available");
?>
--FILE--
<?php
$a = shmop_open(367504384, 'n', 0664, 262144);
$b = shmop_open(367504385, 'n', 0664, 65536);
if ($b == false) {
$b = shmop_open(367504385, 'w', 0664, 65536);
}
var_dump($a !== false, $b !== false);
?>
--EXPECT--
bool(true)
bool(true)