Bug #81283 [PATCH]: Integer overflow in shmop_read()

Edit report at https://bugs.php.net/bug.php?id=81283&edit=1 ID: 81283 Patch added by: cmb@php.net Reported by: mr dot sol dot 7788 at gmail dot com Summary: Integer overflow in shmop_read() Status: Verified Type: Bug Package: Unknown/Other Function Operating System: Linux PHP Version: Irrelevant Block user comment: N Private report: N New Comment: The following pull request has been associated: Patch Name: Fix #81283: shmop_read(): count is out of range On GitHub: https://github.com/php/php-src/pull/7301 Patch: https://github.com/php/php-src/pull/7301.patch Previous Comments: ------------------------------------------------------------------------ [2021-07-23 10:36:04] nikic@php.net The overflow check incorrectly uses INT_MAX instead of ZEND_LONG_MAX. ------------------------------------------------------------------------ [2021-07-23 10:23:18] mr dot sol dot 7788 at gmail dot com Description: ------------ PHP 7.4.3 (cli) Zend Engine v3.4.0 Kubuntu (focal) - x86_64 PHP_INT_SIZE:8 PHP_INT_MAX:9223372036854775807 Created shared memeory with size 28991029248. Write in all diapozon is normal. Read bigest at position 2147483646 one byte. shmop_read($shmp, 2147483647, 1) getted error Warning: shmop_read(): count is out of range in Test script: --------------- <?php $KeyShm = ftok(__FILE__, 'a'); $shmp = shmop_open($KeyShm, 'n', 0644, 28991029248); $WriteRes = shmop_write($shmp, "a", 2147483647);//All ok $ReadRes1 = shmop_read($shmp, 2147483646, 1);//All ok $ReadRes2 = shmop_read($shmp, 2147483647, 1);//Error //Warning: shmop_read(): count is out of range in echo "ReadRes2:'".($ReadRes2!==false?$ReadRes2:'false')."' ".PHP_EOL; shmop_delete($shmp); shmop_close($shmp); Expected result: ---------------- ReadRes2:'a' Actual result: -------------- ReadRes2:'false' ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81283&edit=1