mirror of
https://github.com/php/php-src.git
synced 2026-10-28 17:56:50 +08:00
shmat() returned shm->descriptor + sizeof(shm->descriptor), which scales the pointer-size offset by sizeof(struct shmid_ds), while shmget() reserved only pointer-size bytes for the descriptor and stored that inflated size in shm_segsz. shmop and sysvshm therefore read and wrote past the end of the mapping. Reserve sizeof(struct shmid_ds), return the address right after the descriptor, and keep shm_segsz at the requested size. Closes GH-24042