[php-src] PR #22982: ext/sysvshm: do not trust $size when opening an existing segment
| From: | devnexen | Date: | Fri, 31 Jul 2026 21:39:57 +0000 |
| Subject: | [php-src] PR #22982: ext/sysvshm: do not trust $size when opening an existing segment | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-37432@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/22982
Author: devnexen
shm_attach() wrote the requested size into the header of a segment it did not create, so a foreign
segment framed as larger than it is let shm_put_var() write past the mapping. Take the size from
shmctl() IPC_STAT instead, and reject a segment too small to hold the header.
Noticed while reviewing GH-22959.