Skip to content

sysvmsg/sysvsem: fix IPC_PRIVATE and out-of-range key handling #22956

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iliaal merged 1 commit into from
Jul 31, 2026
Merged

sysvmsg/sysvsem: fix IPC_PRIVATE and out-of-range key handling #22956

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 28 additions & 6 deletions ext/sysvmsg/sysvmsg.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,37 +192,59 @@ PHP_FUNCTION(msg_stat_queue)
/* {{{ Check whether a message queue exists */
PHP_FUNCTION(msg_queue_exists)
{
zend_long key;
zend_long key_arg;
key_t key;

if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &key_arg) == FAILURE) {
RETURN_THROWS();
}

if (zend_parse_parameters(ZEND_NUM_ARGS(), "l", &key) == FAILURE) {
key = (key_t) key_arg;
if ((zend_long) key != key_arg) {
zend_argument_value_error(1, "is out of range");
RETURN_THROWS();
}

if (key == IPC_PRIVATE) {
RETURN_FALSE;
}

RETURN_BOOL(msgget(key, 0) >= 0);
}
/* }}} */

/* {{{ Attach to a message queue */
PHP_FUNCTION(msg_get_queue)
{
zend_long key;
zend_long key_arg;
zend_long perms = 0666;
key_t key;
sysvmsg_queue_t *mq;

if (zend_parse_parameters(ZEND_NUM_ARGS(), "l|l", &key, &perms) == FAILURE) {
if (zend_parse_parameters(ZEND_NUM_ARGS(), "l|l", &key_arg, &perms) == FAILURE) {
RETURN_THROWS();
}

key = (key_t) key_arg;
if ((zend_long) key != key_arg) {

@devnexen devnexen Jul 31, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this part can probably apply to sysvsem too (e.g. sem_get()).

@iliaal iliaal Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added to sem_get(), with a test. Narrowing key to key_t there also meant the five ZEND_XLONG_FMT warnings had to take the original argument.

zend_argument_value_error(1, "is out of range");
RETURN_THROWS();
}

object_init_ex(return_value, sysvmsg_queue_ce);
mq = Z_SYSVMSG_QUEUE_P(return_value);

mq->key = key;
mq->id = msgget(key, 0);
if (key == IPC_PRIVATE) {
mq->id = -1;
} else {
mq->id = msgget(key, 0);
}
if (mq->id < 0) {
/* doesn't already exist; create it */
mq->id = msgget(key, IPC_CREAT | IPC_EXCL | perms);
if (mq->id < 0) {
php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key, strerror(errno));
php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key_arg, strerror(errno));
zval_ptr_dtor(return_value);
RETURN_FALSE;
}
Expand Down
26 changes: 26 additions & 0 deletions ext/sysvmsg/tests/gh9945.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
--TEST--
GH-9945: sysvmsg must reject keys outside the key_t range
--EXTENSIONS--
sysvmsg
--SKIPIF--
<?php
if (PHP_INT_SIZE !== 8) die('skip only for 64-bit');
if (PHP_OS_FAMILY !== 'Linux') die('skip only for platforms with 32-bit key_t');
?>
--FILE--
<?php
try {
msg_queue_exists(0x100000000);
} catch (ValueError $exception) {
echo $exception::class, ": ", $exception->getMessage(), "\n";
}

try {
msg_get_queue(0x100000000);
} catch (ValueError $exception) {
echo $exception::class, ": ", $exception->getMessage(), "\n";
}
?>
--EXPECT--
ValueError: msg_queue_exists(): Argument #1 ($key) is out of range
ValueError: msg_get_queue(): Argument #1 ($key) is out of range
28 changes: 28 additions & 0 deletions ext/sysvmsg/tests/msg_queue_ipc_private.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
--TEST--
msg_queue_exists() and msg_get_queue() with IPC_PRIVATE
--EXTENSIONS--
sysvmsg
--FILE--
<?php
var_dump(msg_queue_exists(0));

$queue = msg_get_queue(0, 0600);

try {
var_dump(msg_queue_exists(0));
printf("%o\n", msg_stat_queue($queue)['msg_perm.mode']);
var_dump(msg_send($queue, 1, 'hello'));
var_dump(msg_receive($queue, 1, $type, 1024, $message));
var_dump($message);
} finally {
var_dump(msg_remove_queue($queue));
}
?>
--EXPECT--
bool(false)
bool(false)
600
bool(true)
bool(true)
string(5) "hello"
bool(true)
21 changes: 14 additions & 7 deletions ext/sysvsem/sysvsem.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,14 +167,21 @@ PHP_MINFO_FUNCTION(sysvsem)
/* {{{ Return an id for the semaphore with the given key, and allow max_acquire (default 1) processes to acquire it simultaneously */
PHP_FUNCTION(sem_get)
{
zend_long key, max_acquire = 1, perm = 0666;
zend_long key_arg, max_acquire = 1, perm = 0666;
bool auto_release = true;
key_t key;
int semid;
struct sembuf sop[3];
int count;
sysvsem_sem *sem_ptr;

if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS(), "l|llb", &key, &max_acquire, &perm, &auto_release)) {
if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS(), "l|llb", &key_arg, &max_acquire, &perm, &auto_release)) {
RETURN_THROWS();
}

key = (key_t) key_arg;
if ((zend_long) key != key_arg) {
zend_argument_value_error(1, "is out of range");
RETURN_THROWS();
}

Expand All @@ -186,7 +193,7 @@ PHP_FUNCTION(sem_get)

semid = semget(key, 3, perm|IPC_CREAT);
if (semid == -1) {
php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key, strerror(errno));
php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key_arg, strerror(errno));
RETURN_FALSE;
}

Expand Down Expand Up @@ -218,15 +225,15 @@ PHP_FUNCTION(sem_get)
sop[2].sem_flg = SEM_UNDO;
while (semop(semid, sop, 3) == -1) {
if (errno != EINTR) {
php_error_docref(NULL, E_WARNING, "Failed acquiring SYSVSEM_SETVAL for key 0x" ZEND_XLONG_FMT ": %s", key, strerror(errno));
php_error_docref(NULL, E_WARNING, "Failed acquiring SYSVSEM_SETVAL for key 0x" ZEND_XLONG_FMT ": %s", key_arg, strerror(errno));
break;
}
}

/* Get the usage count. */
count = semctl(semid, SYSVSEM_USAGE, GETVAL, NULL);
if (count == -1) {
php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key, strerror(errno));
php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key_arg, strerror(errno));
}

/* If we are the only user, then take this opportunity to set the max. */
Expand All @@ -235,7 +242,7 @@ PHP_FUNCTION(sem_get)
union semun semarg;
semarg.val = max_acquire;
if (semctl(semid, SYSVSEM_SEM, SETVAL, semarg) == -1) {
php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key, strerror(errno));
php_error_docref(NULL, E_WARNING, "Failed for key 0x" ZEND_XLONG_FMT ": %s", key_arg, strerror(errno));
}
}

Expand All @@ -246,7 +253,7 @@ PHP_FUNCTION(sem_get)
sop[0].sem_flg = SEM_UNDO;
while (semop(semid, sop, 1) == -1) {
if (errno != EINTR) {
php_error_docref(NULL, E_WARNING, "Failed releasing SYSVSEM_SETVAL for key 0x" ZEND_XLONG_FMT ": %s", key, strerror(errno));
php_error_docref(NULL, E_WARNING, "Failed releasing SYSVSEM_SETVAL for key 0x" ZEND_XLONG_FMT ": %s", key_arg, strerror(errno));
break;
}
}
Expand Down
19 changes: 19 additions & 0 deletions ext/sysvsem/tests/gh9945.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
--TEST--
GH-9945: sem_get() must reject keys outside the key_t range
--EXTENSIONS--
sysvsem
--SKIPIF--
<?php
if (PHP_INT_SIZE !== 8) die('skip only for 64-bit');
if (PHP_OS_FAMILY !== 'Linux') die('skip only for platforms with 32-bit key_t');
?>
--FILE--
<?php
try {
sem_get(0x100000000);
} catch (ValueError $exception) {
echo $exception::class, ": ", $exception->getMessage(), "\n";
}
?>
--EXPECT--
ValueError: sem_get(): Argument #1 ($key) is out of range
Loading