Commit 56ac9dae6e9 for php.net

commit 56ac9dae6e9a75fe9470026f9adfc0b2c0ab8ff7
Merge: 33cdf363263 947f4d2b662
Author: David Carlier <devnexen@gmail.com>
Date:   Sun Aug 2 21:57:21 2026 +0100

    Merge branch 'PHP-8.5'

    * PHP-8.5:
      ext/sysvshm: do not trust $size when opening an existing segment

diff --cc ext/sysvshm/sysvshm.c
index 24403290677,f7b5b0dcdae..448bec89864
--- a/ext/sysvshm/sysvshm.c
+++ b/ext/sysvshm/sysvshm.c
@@@ -126,18 -130,12 +126,19 @@@ PHP_FUNCTION(shm_attach
  	sysvshm_shm *shm_list_ptr;
  	char *shm_ptr;
  	sysvshm_chunk_head *chunk_ptr;
+ 	struct shmid_ds shm_desc;
 -	zend_long shm_key, shm_id, shm_size, shm_flag = 0666;
 -	bool shm_size_is_null = 1;
 +	zend_long shm_key_arg, shm_id, shm_size, shm_flag = 0666;
 +	key_t shm_key;
 +	bool shm_size_is_null = true;
  	bool created = false;

 -	if (SUCCESS != zend_parse_parameters(ZEND_NUM_ARGS(), "l|l!l", &shm_key, &shm_size, &shm_size_is_null, &shm_flag)) {
 +	if (SUCCESS != zend_parse_parameters(ZEND_NUM_ARGS(), "l|l!l", &shm_key_arg, &shm_size, &shm_size_is_null, &shm_flag)) {
 +		RETURN_THROWS();
 +	}
 +
 +	shm_key = (key_t) shm_key_arg;
 +	if ((zend_long) shm_key != shm_key_arg) {
 +		zend_argument_value_error(1, "is out of range");
  		RETURN_THROWS();
  	}

@@@ -164,9 -162,28 +165,28 @@@
  	}

  	if ((shm_ptr = shmat(shm_id, NULL, 0)) == (void *) -1) {
 -		php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", shm_key, strerror(errno));
 +		php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", shm_key_arg, strerror(errno));
  		if (created) {
  			shmctl(shm_id, IPC_RMID, NULL);
+ 		}
+ 		RETURN_FALSE;
+ 	}
+
+ 	if (shmctl(shm_id, IPC_STAT, &shm_desc) < 0) {
 -		php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", shm_key, strerror(errno));
++		php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", shm_key_arg, strerror(errno));
+ 		shmdt(shm_ptr);
+ 		if (created) {
+ 			shmctl(shm_id, IPC_RMID, NULL);
+ 		}
+ 		RETURN_FALSE;
+ 	}
+ 	shm_size = (zend_long)shm_desc.shm_segsz;
+
+ 	if (shm_size < (zend_long) sizeof(sysvshm_chunk_head)) {
 -		php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": segment too small", shm_key);
++		php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": segment too small", shm_key_arg);
+ 		shmdt(shm_ptr);
+ 		if (created) {
+ 			shmctl(shm_id, IPC_RMID, NULL);
  		}
  		RETURN_FALSE;
  	}