Fixed possible memory leaks.

Prevent shm_attach() from destroying non-shm resources.

diff --git a/ext/sysvshm/sysvshm.c b/ext/sysvshm/sysvshm.c
index 7056f660b5427f933f05b70dd121da86a818461e..47b979072d7447da4530827222b5a17089028461 100644 (file)
--- a/ext/sysvshm/sysvshm.c
+++ b/ext/sysvshm/sysvshm.c
@@ -134,25 +134,25 @@ PHP_FUNCTION(shm_attach)
                        shm_key = Z_LVAL_PP(arg_key);
        }
 
-       if ((shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm))) == NULL) {
-               php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed for key 0x%x: cannot allocate internal listelement", shm_key);
-               RETURN_FALSE;
-       }
+       shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm));
 
        /* get the id from a specified key or create new shared memory */
        if ((shm_id = shmget(shm_key, 0, 0)) < 0) {
                if (shm_size < sizeof(sysvshm_chunk_head)) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed for key 0x%x: memorysize too small", shm_key);
+                       efree(shm_list_ptr);
                        RETURN_FALSE;
                }
                if ((shm_id = shmget(shm_key, shm_size, shm_flag | IPC_CREAT | IPC_EXCL)) < 0) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed for key 0x%x: %s", shm_key, strerror(errno));
+                       efree(shm_list_ptr);
                        RETURN_FALSE;
                }
        }
 
        if ((shm_ptr = shmat(shm_id, NULL, 0)) == (void *) - 1) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed for key 0x%x: %s", shm_key, strerror(errno));
+               efree(shm_list_ptr);
                RETURN_FALSE;
        }
 
@@ -179,15 +179,22 @@ PHP_FUNCTION(shm_attach)
 PHP_FUNCTION(shm_detach)
 {
        zval **arg_id;
-       long id;
+       int type;
+       sysvshm_shm *shm_list_ptr;
 
        if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &arg_id) == FAILURE) {
                WRONG_PARAM_COUNT;
        }
 
        convert_to_long_ex(arg_id);
-       id = Z_LVAL_PP(arg_id);
-       zend_list_delete(id);
+       shm_list_ptr = (sysvshm_shm *) zend_list_find(Z_LVAL_PP(arg_id), &type);
+       if (!shm_list_ptr || type != php_sysvshm.le_shm) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "The parameter is not a valid shm_indentifier");
+               RETURN_FALSE;
+       }
+
+       zend_list_delete(Z_LVAL_PP(arg_id));
+
        RETURN_TRUE;
 }
 /* }}} */