Bug #81283 [Opn->Ver]: Integer overflow in shmop_read()

From: Date: Fri, 23 Jul 2021 10:36:04 +0000
Subject: Bug #81283 [Opn->Ver]: Integer overflow in shmop_read()
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-235299@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=81283&edit=1

 ID:                 81283
 Updated by:         nikic@php.net
 Reported by:        mr dot sol dot 7788 at gmail dot com
 Summary:            Integer overflow in shmop_read()
-Status:             Open
+Status:             Verified
 Type:               Bug
 Package:            Unknown/Other Function
 Operating System:   Linux
 PHP Version:        Irrelevant
 Block user comment: N
 Private report:     N

 New Comment:

The overflow check incorrectly uses INT_MAX instead of ZEND_LONG_MAX.


Previous Comments:
------------------------------------------------------------------------
[2021-07-23 10:23:18] mr dot sol dot 7788 at gmail dot com

Description:
------------
PHP 7.4.3 (cli)
Zend Engine v3.4.0
Kubuntu (focal) - x86_64
PHP_INT_SIZE:8 
PHP_INT_MAX:9223372036854775807

Created shared memeory with size 28991029248. Write in all diapozon is normal.
Read bigest at position 2147483646 one byte.
shmop_read($shmp, 2147483647, 1)
getted error 
Warning: shmop_read(): count is out of range in


Test script:
---------------
<?php
$KeyShm = ftok(__FILE__, 'a');
$shmp = shmop_open($KeyShm, 'n', 0644, 28991029248);
$WriteRes = shmop_write($shmp, "a", 2147483647);//All ok
$ReadRes1 = shmop_read($shmp, 2147483646, 1);//All ok
$ReadRes2 = shmop_read($shmp, 2147483647, 1);//Error 
//Warning: shmop_read(): count is out of range in
echo "ReadRes2:'".($ReadRes2!==false?$ReadRes2:'false')."'
".PHP_EOL;
shmop_delete($shmp);
shmop_close($shmp);


Expected result:
----------------
ReadRes2:'a'

Actual result:
--------------
ReadRes2:'false'


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=81283&edit=1

Thread (4 messages)

« previous php.bugs (#235299) next »