[GIT-PULLS] [php-src] PR #22982: ext/sysvshm: do not trust $size when opening an existing segment

[email protected] (devnexen) Fri, 31 Jul 2026 21:39:57 +0000
Newsgroups php.git-pulls
Message-ID <[email protected]>
Pull Request: https://github.com/php/php-src/pull/22982
Author: devnexen

shm_attach() wrote the requested size into the header of a segment it did not create, so a foreign segment framed as larger than it is let shm_put_var() write past the mapping. Take the size from shmctl() IPC_STAT instead, and reject a segment too small to hold the header.

Noticed while reviewing GH-22959.