Fixed possible memory leaks.

Prevent shm_attach() from destroying non-shm resources.

1 files changed, 14 insertions, 7 deletions

diff --git a/ext/sysvshm/sysvshm.c b/ext/sysvshm/sysvshm.c
index 7056f660b5..47b979072d 100644
--- a/ext/sysvshm/sysvshm.c
+++ b/ext/sysvshm/sysvshm.c
@@ -134,25 +134,25 @@ PHP_FUNCTION(shm_attach)
 			shm_key = Z_LVAL_PP(arg_key);
 	}
 
-	if ((shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm))) == NULL) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed for key 0x%x: cannot allocate internal listelement", shm_key);
-		RETURN_FALSE;
-	}
+	shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm));
 
 	/* get the id from a specified key or create new shared memory */
 	if ((shm_id = shmget(shm_key, 0, 0)) < 0) {
 		if (shm_size < sizeof(sysvshm_chunk_head)) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed for key 0x%x: memorysize too small", shm_key);
+			efree(shm_list_ptr);
 			RETURN_FALSE;
 		}
 		if ((shm_id = shmget(shm_key, shm_size, shm_flag | IPC_CREAT | IPC_EXCL)) < 0) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed for key 0x%x: %s", shm_key, strerror(errno));
+			efree(shm_list_ptr);
 			RETURN_FALSE;
 		}
 	}
 
 	if ((shm_ptr = shmat(shm_id, NULL, 0)) == (void *) - 1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed for key 0x%x: %s", shm_key, strerror(errno));
+		efree(shm_list_ptr);
 		RETURN_FALSE;
 	}
 
@@ -179,15 +179,22 @@ PHP_FUNCTION(shm_attach)
 PHP_FUNCTION(shm_detach)
 {
 	zval **arg_id;
-	long id;
+	int type;
+	sysvshm_shm *shm_list_ptr;
 
 	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &arg_id) == FAILURE) {
 		WRONG_PARAM_COUNT;
 	}
 
 	convert_to_long_ex(arg_id);
-	id = Z_LVAL_PP(arg_id);
-	zend_list_delete(id);
+	shm_list_ptr = (sysvshm_shm *) zend_list_find(Z_LVAL_PP(arg_id), &type);
+	if (!shm_list_ptr || type != php_sysvshm.le_shm) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The parameter is not a valid shm_indentifier");
+		RETURN_FALSE;
+	}
+
+	zend_list_delete(Z_LVAL_PP(arg_id));
+
 	RETURN_TRUE;
 }
 /* }}} */