diff options
| author | Christoph M. Becker <cmbecker69@gmx.de> | 2020-03-30 08:58:45 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2020-03-30 08:58:45 +0200 |
| commit | 2a1d7bd802cde49801c83f41397f1bf157ccd018 (patch) | |
| tree | 43b2c615d283eaf1bf65f5254194df2d58a5e21b /ext/shmop | |
| parent | 477efe935bf120255b9e034d934b81f7e75a075f (diff) | |
| parent | 6f8045c47fd6e97b80205a040177358575d0f1f6 (diff) | |
| download | php-git-2a1d7bd802cde49801c83f41397f1bf157ccd018.tar.gz | |
Merge branch 'PHP-7.4'
* PHP-7.4:
Fix #79427: Integer Overflow in shmop_open()
Diffstat (limited to 'ext/shmop')
| -rw-r--r-- | ext/shmop/shmop.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/ext/shmop/shmop.c b/ext/shmop/shmop.c index 446c309458..d718c429c9 100644 --- a/ext/shmop/shmop.c +++ b/ext/shmop/shmop.c @@ -176,6 +176,11 @@ PHP_FUNCTION(shmop_open) goto err; } + if (shm.shm_segsz > ZEND_LONG_MAX) { + php_error_docref(NULL, E_WARNING, "shared memory segment too large to attach"); + goto err; + } + shmop->addr = shmat(shmop->shmid, 0, shmop->shmatflg); if (shmop->addr == (char*) -1) { php_error_docref(NULL, E_WARNING, "Unable to attach to shared memory segment '%s'", strerror(errno)); |