[php-src] master: Merge branch 'PHP-8.4' into PHP-8.5

Author: Ilia Alshanetsky (iliaal) Date: 2026-10-01T17:41:47-04:00 Commit: https://github.com/php/php-src/commit/f991e962b1b8b49999410a38e5484a541e2e087f Raw diff: https://github.com/php/php-src/commit/f991e962b1b8b49999410a38e5484a541e2e087f.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: TSRM: Fix Windows shared memory payload offset Changed paths: A ext/shmop/tests/tsrm_shmat.phpt M NEWS M TSRM/tsrm_win32.c Diff: diff --git a/NEWS b/NEWS index 1cc0c1891fe5..d1bd9c5bfabe 100644 --- a/NEWS +++ b/NEWS @@ -20,6 +20,8 @@ PHP NEWS . Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche) . Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it. (Ilia Alshanetsky) + . Fixed System V shared memory emulation for Windows attaching segments past + the end of their mapping. (Ilia Alshanetsky) - CLI . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during diff --git a/TSRM/tsrm_win32.c b/TSRM/tsrm_win32.c index 4c8fc9d19aa9..54c22266e138 100644 --- a/TSRM/tsrm_win32.c +++ b/TSRM/tsrm_win32.c @@ -635,6 +635,7 @@ static key_t tsrm_choose_random_shm_key(key_t prev_key) { TSRM_API int shmget(key_t key, size_t size, int flags) {/*{{{*/ shm_pair *shm; + size_t mapping_size; char shm_segment[sizeof(SEGMENT_PREFIX INT_MIN_AS_STRING)]; HANDLE shm_handle = NULL; BOOL created = FALSE; @@ -650,16 +651,16 @@ TSRM_API int shmget(key_t key, size_t size, int flags) if (!shm_handle) { if (flags & IPC_CREAT) { - if (size == 0 || size > SIZE_MAX - sizeof(shm->descriptor)) { + if (size == 0 || size > SIZE_MAX - sizeof(*shm->descriptor)) { return -1; } - size += sizeof(shm->descriptor); + mapping_size = size + sizeof(*shm->descriptor); #if SIZEOF_SIZE_T == 8 - DWORD high = size >> 32; - DWORD low = (DWORD)size; + DWORD high = mapping_size >> 32; + DWORD low = (DWORD)mapping_size; #else DWORD high = 0; - DWORD low = size; + DWORD low = mapping_size; #endif shm_handle = CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, high, low, key == IPC_PRIVATE ? NULL : shm_segment); created = TRUE; @@ -730,7 +731,7 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags) return (void*)-1; } - shm->addr = shm->descriptor + sizeof(shm->descriptor); + shm->addr = shm->descriptor + 1; shm->descriptor->shm_atime = time(NULL); shm->descriptor->shm_lpid = getpid(); shm->descriptor->shm_nattch++; diff --git a/ext/shmop/tests/tsrm_shmat.phpt b/ext/shmop/tests/tsrm_shmat.phpt new file mode 100644 index 000000000000..3a5b92efcf87 --- /dev/null +++ b/ext/shmop/tests/tsrm_shmat.phpt @@ -0,0 +1,24 @@ +--TEST-- +TSRM Windows shmop keeps the payload within its mapping +--EXTENSIONS-- +shmop +--SKIPIF-- +<?php +if (PHP_OS_FAMILY !== 'Windows') die('skip only for Windows'); +?> +--FILE-- +<?php +$shm = shmop_open(0, 'c', 0644, 65472); +$payload = str_repeat('x', 65471) . 'z'; +var_dump($shm !== false); +var_dump(shmop_size($shm)); +var_dump(shmop_write($shm, $payload, 0)); +var_dump(shmop_read($shm, 65471, 1)); +var_dump(shmop_delete($shm)); +?> +--EXPECT-- +bool(true) +int(65472) +int(65472) +string(1) "z" +bool(true)