diff options
| author | Dmitry Stogov <dmitry@php.net> | 2010-05-13 08:34:06 +0000 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@php.net> | 2010-05-13 08:34:06 +0000 |
| commit | 32a09f39be4c2cf8da631713e0125f0b9d25a80f (patch) | |
| tree | e7b4e78f65fced2be82fa737e4676ecf40a0f389 | |
| parent | 24704df3a8653ef6b5ed63fc912023747c69aaf8 (diff) | |
| download | php-git-32a09f39be4c2cf8da631713e0125f0b9d25a80f.tar.gz | |
Fixed a possible resource destruction issues in shm_put_var()
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/sysvshm/sysvshm.c | 7 |
2 files changed, 8 insertions, 1 deletions
@@ -23,6 +23,8 @@ PHP NEWS - Fixed very rare memory leak in mysqlnd, when binding thousands of columns. (Andrey) +- Fixed a possible resource destruction issues in shm_put_var() + Reported by Stefan Esser (Dmitry) - Fixed a possible information leak because of interruption of XOR operator. Reported by Stefan Esser (Dmitry) - Fixed a possible memory corruption because of unexpected call-time pass by diff --git a/ext/sysvshm/sysvshm.c b/ext/sysvshm/sysvshm.c index 520b7b798e..a66d85e4c3 100644 --- a/ext/sysvshm/sysvshm.c +++ b/ext/sysvshm/sysvshm.c @@ -251,13 +251,18 @@ PHP_FUNCTION(shm_put_var) if (SUCCESS != zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rlz", &shm_id, &shm_key, &arg_var)) { return; } - SHM_FETCH_RESOURCE(shm_list_ptr, shm_id); /* setup string-variable and serialize */ PHP_VAR_SERIALIZE_INIT(var_hash); php_var_serialize(&shm_var, &arg_var, &var_hash TSRMLS_CC); PHP_VAR_SERIALIZE_DESTROY(var_hash); + shm_list_ptr = zend_fetch_resource(&shm_id TSRMLS_CC, -1, PHP_SHM_RSRC_NAME, NULL, 1, php_sysvshm.le_shm); + if (!shm_list_ptr) { + smart_str_free(&shm_var); + RETURN_FALSE; + } + /* insert serialized variable into shared memory */ ret = php_put_shm_data(shm_list_ptr->ptr, shm_key, shm_var.c, shm_var.len); |