REDHAT-BUG-683183: Integer Overflow

It was reported [1],[2] that there was an integer overflow in PHP's shmopread() function. This function reads a given number of bytes from memory, at a given offset starting from a shared memory area. With a sufficiently large value, more memory is allocated than there is space for, which could result in a segfault because PHP is reading past its own memory. If there is enough allocated memory available, however, PHP could leak up to 2GB of arbitrary memory.

To test:

<?php $shmkey = ftok(FILE, 't'); $shmid = shmopopen($shmkey, "c", 0644, 100); $shmdata = shmopread($shmid, 1, 2147483647); //if there is no segmentation fault past this point, we have 2gb of memory! echo $shmdata; ?>

This sets a start value of 1, and 2^31 (2147483647) as the count:

2147483647+1 = -2147483647

This was corrected upstream [3] for version 5.3.6.

References:

[1] http://openwall.com/lists/oss-security/2011/03/08/9 [2] http://bugs.php.net/54193 [3] http://svn.php.net/viewvc/?view=revision&revision=309018