Fix #81283: shmop can't read beyond 2147483647 bytes

cmb69 · cmb69 · commit 387c0de98312 · 2021-07-23T17:46:42.000+02:00
`start`, `count` and `shmop->size` are `zend_long`, so we must not restrict to `INT_MAX`. Closes GH-7301.
diff --git a/NEWS b/NEWS
@@ -13,6 +13,9 @@ PHP                                                                        NEWS
 - CGI:
   . Fixed bug #80849 (HTTP Status header truncation). (cmb)
 
+- Shmop:
+  . Fixed bug #81283 (shmop can't read beyond 2147483647 bytes). (cmb, Nikita)
+
 - Standard:
   . Fixed bug #72146 (Integer overflow on substr_replace). (cmb)
   . Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).
diff --git a/ext/shmop/shmop.c b/ext/shmop/shmop.c
@@ -251,7 +251,7 @@ PHP_FUNCTION(shmop_read)
 		RETURN_FALSE;
 	}
 
-	if (count < 0 || start > (INT_MAX - count) || start + count > shmop->size) {
+	if (count < 0 || start > (ZEND_LONG_MAX - count) || start + count > shmop->size) {
 		php_error_docref(NULL, E_WARNING, "count is out of range");
 		RETURN_FALSE;
 	}

Original file line number	Diff line number	Diff line change
`@@ -251,7 +251,7 @@ PHP_FUNCTION(shmop_read)`
`251`	`251`	`RETURN_FALSE;`
`252`	`252`	`}`
`253`	`253`
`254`		`- if (count < 0 \|\| start > (INT_MAX - count) \|\| start + count > shmop->size) {`
	`254`	`+ if (count < 0 \|\| start > (ZEND_LONG_MAX - count) \|\| start + count > shmop->size) {`
`255`	`255`	`php_error_docref(NULL, E_WARNING, "count is out of range");`
`256`	`256`	`RETURN_FALSE;`
`257`	`257`	`}`