Skip to content

Commit 0541099

Browse files
committed
Fix OOB read in opcache POSIX largepage page-size selection
create_segments() under HAVE_SHM_CREATE_LARGEPAGE stored the int return of getpagesizes() in a size_t and iterated with a size_t counter. On the getpagesizes() error return (-1) the size_t became SIZE_MAX, passing the > 0 guard, and the unsigned loop counter made i >= 0 always true, so the loop ran from a huge index and read far outside the 3-element shared_segment_sindexes array; even on success, if no returned page size divided requested_size the counter wrapped past 0. Capture the result in a signed int and iterate signed so the error return is rejected and the loop terminates.
1 parent 19f595f commit 0541099

1 file changed

Lines changed: 2 additions & 1 deletion

File tree

ext/opcache/shared_alloc_posix.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,9 +51,10 @@ static int create_segments(size_t requested_size, zend_shared_segment_posix ***s
5151
* only then amd64/i386/arm64 and perharps risc64*
5252
* archs are on interest here.
5353
*/
54-
size_t i, shared_segment_sizes = 0, shared_segment_lg_index = 0;
54+
size_t shared_segment_lg_index = 0;
5555
size_t shared_segment_sindexes[3] = {0};
5656
const size_t entries = sizeof(shared_segment_sindexes) / sizeof(shared_segment_sindexes[0]);
57+
int i, shared_segment_sizes;
5758

5859
shared_segment_sizes = getpagesizes(shared_segment_sindexes, entries);
5960

0 commit comments

Comments
 (0)