[GIT-PULLS] [php-src] PR #22982: ext/sysvshm: do not trust $size when opening an existing segment
[email protected] (devnexen) Fri, 31 Jul 2026 21:39:57 +0000
| Newsgroups | php.git-pulls |
|---|---|
| Message-ID | <[email protected]> |
Pull Request: https://github.com/php/php-src/pull/22982 Author: devnexen shm_attach() wrote the requested size into the header of a segment it did not create, so a foreign segment framed as larger than it is let shm_put_var() write past the mapping. Take the size from shmctl() IPC_STAT instead, and reject a segment too small to hold the header. Noticed while reviewing GH-22959.