[php-src] PHP-8.6: Merge branch 'PHP-8.5' into PHP-8.6

Author: Ilia Alshanetsky (iliaal) Date: 2026-10-01T17:41:48-04:00 Commit: https://github.com/php/php-src/commit/aed9bab13120b3ff538cc8fb1d4a2290b6b79c68 Raw diff: https://github.com/php/php-src/commit/aed9bab13120b3ff538cc8fb1d4a2290b6b79c68.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: TSRM: Fix Windows shared memory payload offset Changed paths: A ext/shmop/tests/tsrm_shmat.phpt M NEWS M TSRM/tsrm_win32.c Diff: diff --git a/NEWS b/NEWS index 0277ee871e22..191a241cb246 100644 --- a/NEWS +++ b/NEWS @@ -36,6 +36,8 @@ PHP NEWS (Arnaud) . Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it. (Ilia Alshanetsky) + . Fixed System V shared memory emulation for Windows attaching segments past + the end of their mapping. (Ilia Alshanetsky) - FFI: . Fixed crashes with FFI callbacks created from __call() trampolines diff --git a/TSRM/tsrm_win32.c b/TSRM/tsrm_win32.c index 90317ab64b19..1e6a2e8db5be 100644 --- a/TSRM/tsrm_win32.c +++ b/TSRM/tsrm_win32.c @@ -633,6 +633,7 @@ static key_t tsrm_choose_random_shm_key(key_t prev_key) { TSRM_API int shmget(key_t key, size_t size, int flags) {/*{{{*/ shm_pair *shm; + size_t mapping_size; char shm_segment[sizeof(SEGMENT_PREFIX INT_MIN_AS_STRING)]; HANDLE shm_handle = NULL; BOOL created = FALSE; @@ -648,16 +649,16 @@ TSRM_API int shmget(key_t key, size_t size, int flags) if (!shm_handle) { if (flags & IPC_CREAT) { - if (size == 0 || size > SIZE_MAX - sizeof(shm->descriptor)) { + if (size == 0 || size > SIZE_MAX - sizeof(*shm->descriptor)) { return -1; } - size += sizeof(shm->descriptor); + mapping_size = size + sizeof(*shm->descriptor); #if SIZEOF_SIZE_T == 8 - DWORD high = size >> 32; - DWORD low = (DWORD)size; + DWORD high = mapping_size >> 32; + DWORD low = (DWORD)mapping_size; #else DWORD high = 0; - DWORD low = size; + DWORD low = mapping_size; #endif shm_handle = CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, high, low, key == IPC_PRIVATE ? NULL : shm_segment); created = TRUE; @@ -728,7 +729,7 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags) return (void*)-1; } - shm->addr = shm->descriptor + sizeof(shm->descriptor); + shm->addr = shm->descriptor + 1; shm->descriptor->shm_atime = time(NULL); shm->descriptor->shm_lpid = getpid(); shm->descriptor->shm_nattch++; diff --git a/ext/shmop/tests/tsrm_shmat.phpt b/ext/shmop/tests/tsrm_shmat.phpt new file mode 100644 index 000000000000..3a5b92efcf87 --- /dev/null +++ b/ext/shmop/tests/tsrm_shmat.phpt @@ -0,0 +1,24 @@ +--TEST-- +TSRM Windows shmop keeps the payload within its mapping +--EXTENSIONS-- +shmop +--SKIPIF-- +<?php +if (PHP_OS_FAMILY !== 'Windows') die('skip only for Windows'); +?> +--FILE-- +<?php +$shm = shmop_open(0, 'c', 0644, 65472); +$payload = str_repeat('x', 65471) . 'z'; +var_dump($shm !== false); +var_dump(shmop_size($shm)); +var_dump(shmop_write($shm, $payload, 0)); +var_dump(shmop_read($shm, 65471, 1)); +var_dump(shmop_delete($shm)); +?> +--EXPECT-- +bool(true) +int(65472) +int(65472) +string(1) "z" +bool(true)