MFH:

	Fixed possible memory leaks.
	Prevent shm_attach() from destroying non-shm resources.

diff --git a/ext/sysvshm/sysvshm.c b/ext/sysvshm/sysvshm.c
index b587a3dbac7c6060f1d0366f2ccdf73b6eedefab..dbe69b356112d0dc4f368083912a2c9b4dfd7695 100644 (file)
--- a/ext/sysvshm/sysvshm.c
+++ b/ext/sysvshm/sysvshm.c
@@ -127,25 +127,25 @@ PHP_FUNCTION(shm_attach)
                        shm_key = Z_LVAL_PP(arg_key);
        }
 
-       if((shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm)))==NULL) {
-               php_error(E_WARNING, "shm_attach() failed for key 0x%x: cannot allocate internal listelement", shm_key);
-               RETURN_FALSE;
-       }
+       shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm));
 
        /* get the id from a specified key or create new shared memory */
        if((shm_id=shmget(shm_key,0,0))<0) {
                if(shm_size<sizeof(sysvshm_chunk_head)) {
                        php_error(E_WARNING, "shm_attach() failed for key 0x%x: memorysize too small", shm_key);
+                       efree(shm_list_ptr);
                        RETURN_FALSE;
                }
                if((shm_id=shmget(shm_key,shm_size,shm_flag|IPC_CREAT|IPC_EXCL))<0) {
                        php_error(E_WARNING, "shmget() failed for key 0x%x: %s", shm_key, strerror(errno));
+                       efree(shm_list_ptr);
                        RETURN_FALSE;
                }
        }
 
        if((shm_ptr = shmat(shm_id,NULL,0))==(void *)-1) {
                php_error(E_WARNING, "shmget() failed for key 0x%x: %s", shm_key, strerror(errno));
+               efree(shm_list_ptr);
                RETURN_FALSE;
        }
 
@@ -172,18 +172,22 @@ PHP_FUNCTION(shm_attach)
    Disconnects from shared memory segment */
 PHP_FUNCTION(shm_detach)
 {
-       pval **arg_id;
-       long id;
+       zval **arg_id;
+       int type;
+       sysvshm_shm *shm_list_ptr;
 
-       if(ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &arg_id) == FAILURE) {
+       if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &arg_id) == FAILURE) {
                WRONG_PARAM_COUNT;
        }
 
        convert_to_long_ex(arg_id);
-       
-       id = Z_LVAL_PP(arg_id);
+       shm_list_ptr = (sysvshm_shm *) zend_list_find(Z_LVAL_PP(arg_id), &type);
+       if (!shm_list_ptr || type != php_sysvshm.le_shm) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "The parameter is not a valid shm_indentifier");
+               RETURN_FALSE;
+       }
 
-       zend_list_delete(id);
+       zend_list_delete(Z_LVAL_PP(arg_id));
 
        RETURN_TRUE;
 }