Fix #78538: shmop memory leak

If the descriptor's refcount drops to zero, we have to unmap the
respective file view, to avoid leaking memory.

diff --git a/NEWS b/NEWS
index e2fe829d40b7f1921d2959f971ffd556d2d3277c..2e7761a5eafc6e75dc8dfa9834bdc8d816a63275 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -39,6 +39,9 @@ PHP                                                                        NEWS
   . Fixed bug #78982 (pdo_pgsql returns dead persistent connection). (SATŌ
     Kentarō)
 
+- Shmop:
+  . Fixed bug #78538 (shmop memory leak). (cmb)
+
 18 Dec 2019, PHP 7.3.13
 
 - Bcmath:

diff --git a/TSRM/tsrm_win32.c b/TSRM/tsrm_win32.c
index 06ca965d641b2da3913a70c3789b0d8616452b09..cb2520e294bc9edcf7090bde0d50fedad5ed6607 100644 (file)
--- a/TSRM/tsrm_win32.c
+++ b/TSRM/tsrm_win32.c
@@ -721,6 +721,7 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 TSRM_API int shmdt(const void *shmaddr)
 {/*{{{*/
        shm_pair *shm = shm_get(0, (void*)shmaddr);
+       int ret;
 
        if (!shm->segment) {
                return -1;
@@ -730,7 +731,12 @@ TSRM_API int shmdt(const void *shmaddr)
        shm->descriptor->shm_lpid  = getpid();
        shm->descriptor->shm_nattch--;
 
-       return UnmapViewOfFile(shm->addr) ? 0 : -1;
+       ret = UnmapViewOfFile(shm->addr) ? 0 : -1;
+       if (!ret  && shm->descriptor->shm_nattch <= 0) {
+               ret = UnmapViewOfFile(shm->descriptor) ? 0 : -1;
+               shm->descriptor = NULL;
+       }
+       return ret;
 }/*}}}*/
 
 TSRM_API int shmctl(int key, int cmd, struct shmid_ds *buf)