Skip to content

Commit 387c0de

Browse files
committed
Fix #81283: shmop can't read beyond 2147483647 bytes
`start`, `count` and `shmop->size` are `zend_long`, so we must not restrict to `INT_MAX`. Closes GH-7301.
1 parent dfd05da commit 387c0de

File tree

2 files changed

+4
-1
lines changed

2 files changed

+4
-1
lines changed

NEWS

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ PHP NEWS
1313
- CGI:
1414
. Fixed bug #80849 (HTTP Status header truncation). (cmb)
1515

16+
- Shmop:
17+
. Fixed bug #81283 (shmop can't read beyond 2147483647 bytes). (cmb, Nikita)
18+
1619
- Standard:
1720
. Fixed bug #72146 (Integer overflow on substr_replace). (cmb)
1821
. Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).

ext/shmop/shmop.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ PHP_FUNCTION(shmop_read)
251251
RETURN_FALSE;
252252
}
253253

254-
if (count < 0 || start > (INT_MAX - count) || start + count > shmop->size) {
254+
if (count < 0 || start > (ZEND_LONG_MAX - count) || start + count > shmop->size) {
255255
php_error_docref(NULL, E_WARNING, "count is out of range");
256256
RETURN_FALSE;
257257
}

0 commit comments

Comments
 (0)