From: Christoph M. Becker <cmbecker69@gmx.de>
Date: Mon, 30 Mar 2020 06:58:45 +0000 (+0200)
Subject: Merge branch 'PHP-7.4'
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=2a1d7bd802cde49801c83f41397f1bf157ccd018;p=php

Merge branch 'PHP-7.4'

* PHP-7.4:
  Fix #79427: Integer Overflow in shmop_open()
---

2a1d7bd802cde49801c83f41397f1bf157ccd018
diff --cc ext/shmop/shmop.c
index 446c309458,07414f2bca..d718c429c9
--- a/ext/shmop/shmop.c
+++ b/ext/shmop/shmop.c
@@@ -176,9 -207,14 +176,14 @@@ PHP_FUNCTION(shmop_open
  		goto err;
  	}
  
+ 	if (shm.shm_segsz > ZEND_LONG_MAX) {
+ 		php_error_docref(NULL, E_WARNING, "shared memory segment too large to attach");
+ 		goto err;
+ 	}
+ 
  	shmop->addr = shmat(shmop->shmid, 0, shmop->shmatflg);
  	if (shmop->addr == (char*) -1) {
 -		php_error_docref(NULL, E_WARNING, "unable to attach to shared memory segment '%s'", strerror(errno));
 +		php_error_docref(NULL, E_WARNING, "Unable to attach to shared memory segment '%s'", strerror(errno));
  		goto err;
  	}