From: Ilia Alshanetsky <iliaa@php.net>
Date: Wed, 21 Apr 2004 00:11:30 +0000 (+0000)
Subject: MFH:
X-Git-Tag: php-4.3.7RC1~65
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=1aad1b4291c0d3f5ed855418b1b607b44bfa3273;p=php

MFH:
	Fixed possible memory leaks.
	Prevent shm_attach() from destroying non-shm resources.
---

diff --git a/ext/sysvshm/sysvshm.c b/ext/sysvshm/sysvshm.c
index b587a3dbac..dbe69b3561 100644
--- a/ext/sysvshm/sysvshm.c
+++ b/ext/sysvshm/sysvshm.c
@@ -127,25 +127,25 @@ PHP_FUNCTION(shm_attach)
 			shm_key = Z_LVAL_PP(arg_key);
 	}
 
-	if((shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm)))==NULL) {
-		php_error(E_WARNING, "shm_attach() failed for key 0x%x: cannot allocate internal listelement", shm_key);
-		RETURN_FALSE;
-	}
+	shm_list_ptr = (sysvshm_shm *) emalloc(sizeof(sysvshm_shm));
 
 	/* get the id from a specified key or create new shared memory */
 	if((shm_id=shmget(shm_key,0,0))<0) {
 		if(shm_size<sizeof(sysvshm_chunk_head)) {
 			php_error(E_WARNING, "shm_attach() failed for key 0x%x: memorysize too small", shm_key);
+			efree(shm_list_ptr);
 			RETURN_FALSE;
 		}
 		if((shm_id=shmget(shm_key,shm_size,shm_flag|IPC_CREAT|IPC_EXCL))<0) {
 			php_error(E_WARNING, "shmget() failed for key 0x%x: %s", shm_key, strerror(errno));
+			efree(shm_list_ptr);
 			RETURN_FALSE;
 		}
 	}
 
 	if((shm_ptr = shmat(shm_id,NULL,0))==(void *)-1) {
 		php_error(E_WARNING, "shmget() failed for key 0x%x: %s", shm_key, strerror(errno));
+		efree(shm_list_ptr);
 		RETURN_FALSE;
 	}
 
@@ -172,18 +172,22 @@ PHP_FUNCTION(shm_attach)
    Disconnects from shared memory segment */
 PHP_FUNCTION(shm_detach)
 {
-	pval **arg_id;
-	long id;
+	zval **arg_id;
+	int type;
+	sysvshm_shm *shm_list_ptr;
 
-	if(ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &arg_id) == FAILURE) {
+	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &arg_id) == FAILURE) {
 		WRONG_PARAM_COUNT;
 	}
 
 	convert_to_long_ex(arg_id);
-	
-	id = Z_LVAL_PP(arg_id);
+	shm_list_ptr = (sysvshm_shm *) zend_list_find(Z_LVAL_PP(arg_id), &type);
+	if (!shm_list_ptr || type != php_sysvshm.le_shm) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The parameter is not a valid shm_indentifier");
+		RETURN_FALSE;
+	}
 
-	zend_list_delete(id);
+	zend_list_delete(Z_LVAL_PP(arg_id));
 
 	RETURN_TRUE;
 }