Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3:
  Fix GH-16591: Assertion error in shm_put_var

NEWS

@@ -19,6 +19,9 @@ PHP                                                                        NEWS
   . Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed
     SplFileObject::__constructor). (Girgias)
 
+- SysVShm:
+  . Fixed bug GH-16591 (Assertion error in shm_put_var). (nielsdos, cmb)
+
 24 Oct 2024, PHP 8.4.0RC3
 
 - Cli:

ext/sysvshm/sysvshm.c

@@ -256,6 +256,12 @@ PHP_FUNCTION(shm_put_var)
 	php_var_serialize(&shm_var, arg_var, &var_hash);
 	PHP_VAR_SERIALIZE_DESTROY(var_hash);
 
+	if (UNEXPECTED(!shm_list_ptr->ptr)) {
+		smart_str_free(&shm_var);
+		zend_throw_error(NULL, "Shared memory block has been destroyed by the serialization function");
+		RETURN_THROWS();
+	}
+
 	/* insert serialized variable into shared memory */
 	ret = php_put_shm_data(shm_list_ptr->ptr, shm_key, shm_var.s? ZSTR_VAL(shm_var.s) : NULL, shm_var.s? ZSTR_LEN(shm_var.s) : 0);
 

ext/sysvshm/tests/gh16591.phpt

@@ -0,0 +1,25 @@
+--TEST--
+GH-16591 (Assertion error in shm_put_var)
+--EXTENSIONS--
+sysvshm
+--FILE--
+<?php
+
+class C {
+    function __serialize(): array {
+        global $mem;
+        shm_detach($mem);
+        return ['a' => 'b'];
+    }
+}
+
+$mem = shm_attach(1);
+try {
+    shm_put_var($mem, 1, new C);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Shared memory block has been destroyed by the serialization function