Assertion error in shm_put_var

[chibinz]

Description

The following code:

<?php


class C {
 function __serialize() {
 global $mem;
 shm_detach($mem);
 }
}

$mem = shm_attach(1);
shm_put_var($mem, 1, new C);

Resulted in this output:

php: /tmp/php-asan/ext/sysvshm/sysvshm.c:398: zend_long php_check_shm_data(sysvshm_chunk_head *, zend_long): Assertion `ptr' failed.

PHP Version

PHP 8.5.0-dev

Operating System

No response

[cmb69]

Yeah, destructors can be so destructive.

In this case we may swap the check and the serialization, or maybe duplicate the check after serialization:

php-src/ext/sysvshm/sysvshm.c

Lines 248 to 257 in 922bd2f

	shm_list_ptr = Z_SYSVSHM_P(shm_id);
	if (!shm_list_ptr->ptr) {
	zend_throw_error(NULL, "Shared memory block has already been destroyed");
	RETURN_THROWS();
	}
	/* setup string-variable and serialize */
	PHP_VAR_SERIALIZE_INIT(var_hash);
	php_var_serialize(&shm_var, arg_var, &var_hash);
	PHP_VAR_SERIALIZE_DESTROY(var_hash);

[ndossche]

Probably just duplicate the check because we also shouldn't attempt to serialize if it's already been destroyed