[sysvshm] Clamp shm_get_var chunk length to segment bounds

shm_get_var() trusted the sysvshm_chunk->length field read straight from
the shared memory segment and handed it to php_var_unserialize() as the
end bound: a hostile segment claiming a multi-gigabyte length made the
parser read past ptr->end and past the end of the SysV mapping. Reject a
negative or out-of-bounds length with the existing corruption warning and
harden php_check_shm_data() so a chain walk never dereferences a chunk
header that does not fully fit before ptr->end. Sibling audit:
php_remove_shm_data() only memmoves when memcpy_len > 0, which bounds it
to [shm_varpos, old end), and sysvmsg unserializes exactly msgrcv()'s
kernel-bounded byte count, so both are unaffected.

Author: iliaal

ext/sysvshm/sysvshm.c

@@ -309,6 +309,8 @@ PHP_FUNCTION(shm_get_var)
 	sysvshm_shm *shm_list_ptr;
 	char *shm_data;
 	zend_long shm_varpos;
+	zend_long shm_avail;
+	zend_long shm_len;
 	sysvshm_chunk *shm_var;
 	php_unserialize_data_t var_hash;
 
@@ -331,10 +333,16 @@ PHP_FUNCTION(shm_get_var)
 		RETURN_FALSE;
 	}
 	shm_var = (sysvshm_chunk*) ((char *)shm_list_ptr->ptr + shm_varpos);
+	shm_avail = shm_list_ptr->ptr->end - shm_varpos - (zend_long) sizeof(sysvshm_chunk);
+	if (shm_var->length < 0 || shm_var->length > shm_avail) {
+		php_error_docref(NULL, E_WARNING, "Variable data in shared memory is corrupted");
+		RETURN_FALSE;
+	}
+	shm_len = shm_var->length;
 	shm_data = &shm_var->mem;
 
 	PHP_VAR_UNSERIALIZE_INIT(var_hash);
-	int res = php_var_unserialize(return_value, (const unsigned char **) &shm_data, (unsigned char *) shm_data + shm_var->length, &var_hash);
+	int res = php_var_unserialize(return_value, (const unsigned char **) &shm_data, (unsigned char *) shm_data + shm_len, &var_hash);
 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 	if (res != 1) {
 		php_error_docref(NULL, E_WARNING, "Variable data in shared memory is corrupted");
@@ -433,7 +441,7 @@ static zend_long php_check_shm_data(sysvshm_chunk_head *ptr, zend_long key)
 	pos = ptr->start;
 
 	for (;;) {
-		if (pos >= ptr->end) {
+		if (ptr->end - pos < (zend_long) sizeof(sysvshm_chunk)) {
 			return -1;
 		}
 		shm_var = (sysvshm_chunk*) ((char *) ptr + pos);

ext/sysvshm/tests/shm_get_var_chunk_length_bounds.phpt

@@ -0,0 +1,71 @@
+--TEST--
+shm_get_var() must not trust the chunk length stored in a hostile segment for unserialize()
+--EXTENSIONS--
+sysvshm
+ffi
+--FILE--
+<?php
+
+function craft_hostile_segment(int $key, int $len): void {
+    $ffi = FFI::cdef("
+        typedef struct { char magic[6]; long start; long end; long free_; long total; } head_t;
+        typedef struct { long key; long length; long next; char mem[16]; } chunk_t;
+        int shmget(int, int, int);
+        void *shmat(int, const void *, int);
+    ");
+    $id = $ffi->shmget($key, 4096, 0666 | 01000);
+    if ($id < 0) {
+        echo "shm setup failed\n";
+        return;
+    }
+    $p = $ffi->shmat($id, NULL, 0);
+    if ($p == $ffi->cast('char*', -1)) {
+        echo "shmat failed\n";
+        return;
+    }
+    FFI::memset($p, 0, 4096);
+    $head = $ffi->cast('head_t*', $p);
+    FFI::memcpy($head->magic, "PHP_SM", 6);
+    $head->start = 40;
+    $head->end = 4096;
+    $head->free_ = 0;
+    $head->total = 4096;
+    $chunk = $ffi->cast('chunk_t*', $ffi->cast('char*', $p) + 40);
+    $chunk->key = 1;
+    $chunk->length = $len;
+    $chunk->next = 4096 - 40;
+    FFI::memcpy($chunk->mem, "i:42;", 5);
+}
+
+$key1 = 0x5A5A0E01;
+$key2 = 0x5A5A0E02;
+
+$old = @shm_attach($key1);
+if ($old !== false) {
+    shm_remove($old);
+}
+$old = @shm_attach($key2);
+if ($old !== false) {
+    shm_remove($old);
+}
+craft_hostile_segment($key1, PHP_INT_MAX);
+
+$shm = shm_attach($key1, 4096);
+var_dump(shm_has_var($shm, 1));
+var_dump(shm_get_var($shm, 1));
+shm_remove($shm);
+
+$shm2 = shm_attach($key2, 4096);
+shm_put_var($shm2, 1, 42);
+var_dump(shm_get_var($shm2, 1));
+shm_remove($shm2);
+
+echo "Done\n";
+?>
+--EXPECTF--
+bool(true)
+
+Warning: shm_get_var(): Variable data in shared memory is corrupted in %s on line %d
+bool(false)
+int(42)
+Done