Skip to content

TSRM: Fix Windows shared memory payload offset #24042

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
iliaal wants to merge 1 commit into from
Closed

TSRM: Fix Windows shared memory payload offset #24042

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@ PHP NEWS
throwing deprecation). (lazerg)
. Fixed use-after-free when a dl()-loaded extension declares a frameless
function and a later request calls it. (Ilia Alshanetsky)
. Fixed System V shared memory emulation for Windows attaching segments past
the end of their mapping. (Ilia Alshanetsky)

- DOM:
. Fixed use-after-free when re-constructing a DOMXPath whose php:function
Expand Down
13 changes: 7 additions & 6 deletions TSRM/tsrm_win32.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -635,6 +635,7 @@ static key_t tsrm_choose_random_shm_key(key_t prev_key) {
TSRM_API int shmget(key_t key, size_t size, int flags)
{/*{{{*/
shm_pair *shm;
size_t mapping_size;
char shm_segment[sizeof(SEGMENT_PREFIX INT_MIN_AS_STRING)];
HANDLE shm_handle = NULL, info_handle = NULL;
BOOL created = FALSE;
Expand All @@ -650,16 +651,16 @@ TSRM_API int shmget(key_t key, size_t size, int flags)

if (!shm_handle) {
if (flags & IPC_CREAT) {
if (size == 0 || size > SIZE_MAX - sizeof(shm->descriptor)) {
if (size == 0 || size > SIZE_MAX - sizeof(*shm->descriptor)) {
return -1;
}
size += sizeof(shm->descriptor);
mapping_size = size + sizeof(*shm->descriptor);
#if SIZEOF_SIZE_T == 8
DWORD high = size >> 32;
DWORD low = (DWORD)size;
DWORD high = mapping_size >> 32;
DWORD low = (DWORD)mapping_size;
#else
DWORD high = 0;
DWORD low = size;
DWORD low = mapping_size;
#endif
shm_handle = CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, high, low, key == IPC_PRIVATE ? NULL : shm_segment);
created = TRUE;
Expand Down Expand Up @@ -730,7 +731,7 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags)
return (void*)-1;
}

shm->addr = shm->descriptor + sizeof(shm->descriptor);
shm->addr = shm->descriptor + 1;
shm->descriptor->shm_atime = time(NULL);
shm->descriptor->shm_lpid = getpid();
shm->descriptor->shm_nattch++;
Expand Down
24 changes: 24 additions & 0 deletions ext/shmop/tests/tsrm_shmat.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
--TEST--
TSRM Windows shmop keeps the payload within its mapping
--EXTENSIONS--
shmop
--SKIPIF--
<?php
if (PHP_OS_FAMILY !== 'Windows') die('skip only for Windows');
?>
--FILE--
<?php
$shm = shmop_open(0, 'c', 0644, 65472);
$payload = str_repeat('x', 65471) . 'z';
var_dump($shm !== false);
var_dump(shmop_size($shm));
var_dump(shmop_write($shm, $payload, 0));
var_dump(shmop_read($shm, 65471, 1));
var_dump(shmop_delete($shm));
?>
--EXPECT--
bool(true)
int(65472)
int(65472)
string(1) "z"
bool(true)
Loading