Commit 0541099
committed
Fix OOB read in opcache POSIX largepage page-size selection
create_segments() under HAVE_SHM_CREATE_LARGEPAGE stored the int return
of getpagesizes() in a size_t and iterated with a size_t counter. On the
getpagesizes() error return (-1) the size_t became SIZE_MAX, passing the
> 0 guard, and the unsigned loop counter made i >= 0 always true, so the
loop ran from a huge index and read far outside the 3-element
shared_segment_sindexes array; even on success, if no returned page size
divided requested_size the counter wrapped past 0. Capture the result in
a signed int and iterate signed so the error return is rejected and the
loop terminates.1 parent 19f595f commit 0541099
1 file changed
Lines changed: 2 additions & 1 deletion
File tree
- ext/opcache
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
51 | 51 | | |
52 | 52 | | |
53 | 53 | | |
54 | | - | |
| 54 | + | |
55 | 55 | | |
56 | 56 | | |
| 57 | + | |
57 | 58 | | |
58 | 59 | | |
59 | 60 | | |
| |||
0 commit comments