Fix #81283: shmop can't read beyond 2147483647 bytes

`start`, `count` and `shmop->size` are `zend_long`, so we must not restrict to `INT_MAX`. Closes GH-7301.
php · Jul 23, 2021 · 387c0de · 387c0de
1 parent dfd05da
commit 387c0de
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -13,6 +13,9 @@ PHP                                                                        NEWS
 - CGI:
   . Fixed bug #80849 (HTTP Status header truncation). (cmb)
 
+- Shmop:
+  . Fixed bug #81283 (shmop can't read beyond 2147483647 bytes). (cmb, Nikita)
+
 - Standard:
   . Fixed bug #72146 (Integer overflow on substr_replace). (cmb)
   . Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).

diff --git a/ext/shmop/shmop.c b/ext/shmop/shmop.c
@@ -251,7 +251,7 @@ PHP_FUNCTION(shmop_read)
 		RETURN_FALSE;
 	}
 
-	if (count < 0 || start > (INT_MAX - count) || start + count > shmop->size) {
+	if (count < 0 || start > (ZEND_LONG_MAX - count) || start + count > shmop->size) {
 		php_error_docref(NULL, E_WARNING, "count is out of range");
 		RETURN_FALSE;
 	}