ext/sysvmsg: fix IPC_PRIVATE and out-of-range key handling

msgget() always creates a queue for IPC_PRIVATE, so the existence probe
in msg_queue_exists() leaks one per call, and the same probe in
msg_get_queue() shadows the IPC_CREAT branch and hands back a queue with
no permission bits. Skip the probe for IPC_PRIVATE. Both functions also
passed the zend_long key straight to msgget(), where it truncates to
key_t; they now reject out-of-range keys as shmop_open() and
shm_attach() have since GH-9945.

Closes GH-22956

Author: iliaal

NEWS

@@ -25,6 +25,12 @@ PHP                                                                        NEWS
     is_writable(), is_readable(), is_executable(), is_file(), is_dir(),
     is_link(), file_exists(), lstat(), stat(). (Girgias)
 
+- Sysvmsg:
+  . Fixed msg_queue_exists() creating and leaking a message queue when passed
+    IPC_PRIVATE. (iliaal)
+  . Fixed msg_queue_exists() and msg_get_queue() to throw a ValueError for keys
+    outside the key_t range. (iliaal)
+
 30 Jul 2026, PHP 8.6.0alpha3
 
 - Core:

ext/sysvmsg/sysvmsg.c

@@ -192,37 +192,59 @@ PHP_FUNCTION(msg_stat_queue)
 /* {{{ Check whether a message queue exists */
 PHP_FUNCTION(msg_queue_exists)
 {
-	zend_long key;
+	zend_long key_arg;
+	key_t key;
+
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &key_arg) == FAILURE)	{
+		RETURN_THROWS();
+	}
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &key) == FAILURE)	{
+	key = (key_t) key_arg;
+	if ((zend_long) key != key_arg) {
+		zend_argument_value_error(1, "is out of range");
 		RETURN_THROWS();
 	}
 
+	if (key == IPC_PRIVATE) {
+		RETURN_FALSE;
+	}
+
 	RETURN_BOOL(msgget(key, 0) >= 0);
 }
 /* }}} */
 
 /* {{{ Attach to a message queue */
 PHP_FUNCTION(msg_get_queue)
 {
-	zend_long key;
+	zend_long key_arg;
 	zend_long perms = 0666;
+	key_t key;
 	sysvmsg_queue_t *mq;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l|l", &key, &perms) == FAILURE)	{
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "l|l", &key_arg, &perms) == FAILURE)	{
+		RETURN_THROWS();
+	}
+
+	key = (key_t) key_arg;
+	if ((zend_long) key != key_arg) {
+		zend_argument_value_error(1, "is out of range");
 		RETURN_THROWS();
 	}
 
 	object_init_ex(return_value, sysvmsg_queue_ce);
 	mq = Z_SYSVMSG_QUEUE_P(return_value);
 
 	mq->key = key;
-	mq->id = msgget(key, 0);
+	if (key == IPC_PRIVATE) {
+		mq->id = -1;
+	} else {
+		mq->id = msgget(key, 0);
+	}
 	if (mq->id < 0)	{
 		/* doesn't already exist; create it */
 		mq->id = msgget(key, IPC_CREAT | IPC_EXCL | perms);
 		if (mq->id < 0)	{
-			php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key, strerror(errno));
+			php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key_arg, strerror(errno));
 			zval_ptr_dtor(return_value);
 			RETURN_FALSE;
 		}

ext/sysvmsg/tests/gh9945.phpt

@@ -0,0 +1,26 @@
+--TEST--
+GH-9945: sysvmsg must reject keys outside the key_t range
+--EXTENSIONS--
+sysvmsg
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE !== 8) die('skip only for 64-bit');
+if (PHP_OS_FAMILY !== 'Linux') die('skip only for platforms with 32-bit key_t');
+?>
+--FILE--
+<?php
+try {
+    msg_queue_exists(0x100000000);
+} catch (ValueError $exception) {
+    echo $exception::class, ": ", $exception->getMessage(), "\n";
+}
+
+try {
+    msg_get_queue(0x100000000);
+} catch (ValueError $exception) {
+    echo $exception::class, ": ", $exception->getMessage(), "\n";
+}
+?>
+--EXPECT--
+ValueError: msg_queue_exists(): Argument #1 ($key) is out of range
+ValueError: msg_get_queue(): Argument #1 ($key) is out of range

ext/sysvmsg/tests/msg_queue_ipc_private.phpt

@@ -0,0 +1,28 @@
+--TEST--
+msg_queue_exists() and msg_get_queue() with IPC_PRIVATE
+--EXTENSIONS--
+sysvmsg
+--FILE--
+<?php
+var_dump(msg_queue_exists(0));
+
+$queue = msg_get_queue(0, 0600);
+
+try {
+    var_dump(msg_queue_exists(0));
+    printf("%o\n", msg_stat_queue($queue)['msg_perm.mode']);
+    var_dump(msg_send($queue, 1, 'hello'));
+    var_dump(msg_receive($queue, 1, $type, 1024, $message));
+    var_dump($message);
+} finally {
+    var_dump(msg_remove_queue($queue));
+}
+?>
+--EXPECT--
+bool(false)
+bool(false)
+600
+bool(true)
+bool(true)
+string(5) "hello"
+bool(true)