[PHP-CVS] [php-src] master: Merge branch 'PHP-8.5'

Author: Ilia Alshanetsky (iliaal)
Date: 2026-07-31T16:46:55-04:00

Commit: https://github.com/php/php-src/commit/949fdc41d9fc2f5a0d39b8eca381a4a8f5dabe99
Raw diff: https://github.com/php/php-src/commit/949fdc41d9fc2f5a0d39b8eca381a4a8f5dabe99.diff

Merge branch 'PHP-8.5'

* PHP-8.5:
  ext/sysvshm: don't orphan the segment shm_attach() just created

Changed paths:
  A  ext/sysvshm/tests/shm_attach_failed_attach.phpt
  M  ext/sysvshm/sysvshm.c


Diff:

diff --git a/ext/sysvshm/sysvshm.c b/ext/sysvshm/sysvshm.c
index 6ca06be935d9..244032906772 100644
--- a/ext/sysvshm/sysvshm.c
+++ b/ext/sysvshm/sysvshm.c
@@ -129,6 +129,7 @@ PHP_FUNCTION(shm_attach)
 	zend_long shm_key_arg, shm_id, shm_size, shm_flag = 0666;
 	key_t shm_key;
 	bool shm_size_is_null = true;
+	bool created = false;
 
 	if (SUCCESS != zend_parse_parameters(ZEND_NUM_ARGS(), "l|l!l", &shm_key_arg, &shm_size, &shm_size_is_null, &shm_flag)) {
 		RETURN_THROWS();
@@ -159,10 +160,14 @@ PHP_FUNCTION(shm_attach)
 			php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", shm_key_arg, strerror(errno));
 			RETURN_FALSE;
 		}
+		created = true;
 	}
 
 	if ((shm_ptr = shmat(shm_id, NULL, 0)) == (void *) -1) {
 		php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", shm_key_arg, strerror(errno));
+		if (created) {
+			shmctl(shm_id, IPC_RMID, NULL);
+		}
 		RETURN_FALSE;
 	}
 
diff --git a/ext/sysvshm/tests/shm_attach_failed_attach.phpt b/ext/sysvshm/tests/shm_attach_failed_attach.phpt
new file mode 100644
index 000000000000..34b3261a246b
--- /dev/null
+++ b/ext/sysvshm/tests/shm_attach_failed_attach.phpt
@@ -0,0 +1,34 @@
+--TEST--
+shm_attach() removes the segment it created when shmat() fails
+--EXTENSIONS--
+sysvshm
+posix
+--SKIPIF--
+<?php
+if (posix_geteuid() === 0) die('skip cannot run as root');
+?>
+--FILE--
+<?php
+$key = ftok(__FILE__, 't');
+
+var_dump(shm_attach($key, 1024, 0));
+
+$segment = shm_attach($key, 1024, 0600);
+
+if (!$segment instanceof SysvSharedMemory) {
+    die("the key is still held by the segment of the failed attach\n");
+}
+
+try {
+    var_dump(shm_put_var($segment, 1, 'value'));
+    var_dump(shm_get_var($segment, 1));
+} finally {
+    var_dump(shm_remove($segment));
+}
+?>
+--EXPECTF--
+Warning: shm_attach(): Failed for key 0x%x: %s in %s on line %d
+bool(false)
+bool(true)
+string(5) "value"
+bool(true)