[php-src] Issue #9945: shmop_open should throw ValueError for ids overflowing sizeof int
| From: | TysonAndre | Date: | Sun, 13 Nov 2022 21:12:18 +0000 |
| Subject: | [php-src] Issue #9945: shmop_open should throw ValueError for ids overflowing sizeof int | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-242811@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/9945
Author: TysonAndre
### Description
The following code:
```php
<?php // based on ext/shmop/tests/shmop_open_private.phpt
$write = 'test';
$shm1 = shmop_open(0x2_0000_0001, 'c', 0777, 1024);
shmop_write($shm1, $write, 0);
$shm2 = shmop_open(0x1_0000_0001, 'c', 0777, 1024);
$read = shmop_read($shm2, 0, 4);
var_dump(is_string($read) && $read !== $write);
```
Resulted in this output:
```
bool(false)
```
But I expected this output instead:
```
bool(true)
```
(seen on 64-bit linux with sizeof(int) == 4, sizeof(zend_long) == 8)
Not really something users are likely to do deliberately
This also means that 0x1_0000_0000 is an alias for IPC_PRIVATE, which always creates a new memory
segment.
Noticed while looking into #9944
### PHP Version
Any
### Operating System
_No response_