Files
php-src/TSRM
Ilia Alshanetsky e50b8b05be TSRM: Fix Windows shared memory payload offset
shmat() returned shm->descriptor + sizeof(shm->descriptor), which scales the
pointer-size offset by sizeof(struct shmid_ds), while shmget() reserved only
pointer-size bytes for the descriptor and stored that inflated size in
shm_segsz. shmop and sysvshm therefore read and wrote past the end of the
mapping. Reserve sizeof(struct shmid_ds), return the address right after the
descriptor, and keep shm_segsz at the requested size.

Closes GH-24042
2026-10-01 17:18:50 -04:00
..
2006-01-04 23:55:42 +00:00