[php-src] PR #22956: ext/sysvmsg: fix IPC_PRIVATE and out-of-range key handling
| From: | iliaal | Date: | Thu, 30 Jul 2026 22:03:27 +0000 |
| Subject: | [php-src] PR #22956: ext/sysvmsg: fix IPC_PRIVATE and out-of-range key handling | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37392@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/22956
Author: iliaal
msgget() has no size argument to fail on, so unlike shmget() it always creates when handed
IPC_PRIVATE.
msg_queue_exists(0) creates a queue with mode 0000, throws away the id and
returns true; the same probe in msg_get_queue() succeeds, so the create call never runs
and the returned object wraps a queue with no permission bits.
```php
var_dump(msg_queue_exists(0)); // true, one queue leaked per call
$q = msg_get_queue(0, 0600);
var_dump(msg_stat_queue($q)); // false: mode is 0000, not 0600
```
Both now skip the probe for IPC_PRIVATE. msg_queue_exists() returns false, since no queue is ever
addressable by that key, and msg_get_queue() goes straight to msgget(key, IPC_CREAT | IPC_EXCL |
perms).
The out-of-range key check mirrors GH-9945, which landed for shmop_open() and shm_attach() in
34116adc119 and was never applied here. sysvmsg still passed a zend_long to msgget(), so 0x100000000
truncates to key_t 0 and creates a queue the same way.
Noticed while reviewing php/php-src#22912, where two of the test workarounds exist because of this.