php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #33011 shmop: can still open segment for reading after shmop_delete
Submitted: 2005-05-12 04:33 UTC Modified: 2013-02-18 00:12 UTC
Votes:16
Avg. Score:4.6 ± 0.6
Reproduced:14 of 14 (100.0%)
Same Version:4 (28.6%)
Same OS:11 (78.6%)
From: joe at bs0 dot com Assigned:
Status: No Feedback Package: Semaphore related
PHP Version: 5.2.6 OS: win32 only
Private report: No CVE-ID: None
Have you experienced this issue?
Rate the importance of this bug to you:

 [2005-05-12 04:33 UTC] joe at bs0 dot com
Description:
------------
Tested with iis/php5.0.4, iis/php4.3.11, apache2/php4.3.11 - same problem.  after a succesful call to shmop_delete, the shared memory can still be opened, and the previous values read in.  Delete call seems to have no effect.

Each step is done in new request:
1)Create shared memory block, populate with string.
2)open block, read in string
3)open block, call shmop_delete (returns true)
4)open block, read in string <- should not be able to open block for reading at this point.


looks to be the same as Bug #28965, this bug has status of No Feedback, so opening a new one.

Reproduce code:
---------------
Code to reproduce:
http://bs0.com/shmop/shmop_test.php.txt

Expected result:
----------------
leave only one step uncommented at a time, at step 4, the open should fail and no data should be read in.

Actual result:
--------------
After step 4, memory is still opened/data is read in.

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-05-15 02:34 UTC] joe at bs0 dot com
as short as I can make it:

<?php
$toWrite = 'test string';	
$shm_len = strlen($toWrite);

$shm_id = shmop_open(0xff3, "c", 0644, $shm_len);

shmop_write($shm_id, $toWrite, 0);
shmop_close($shm_id);

$shm_id = shmop_open(0xff3, "a", 0, 0);	
$data = shmop_read($shm_id, 0, $shm_len);	
shmop_close($shm_id);

$shm_id = shmop_open(0xff3, "w", 0, 0);	

if (!shmop_delete($shm_id)) {
	echo "Couldn't mark shared memory block for deletion.<br/>";
}
else {
	echo "shared memory block marked for deletion.<br/>";	
}

shmop_close($shm_id);
echo 'block closed.<br/>';

$shm_id = shmop_open(0xff3, "a", 0, 0);	

if($shm_id) {
	$data = shmop_read($shm_id, 0, $shm_len);	
	shmop_close($shm_id);	
	
	echo 'ERROR: Previously deleted block able to be opened.<br/>';
	echo 'Data read : "' . $data . '"';
}
else {
	echo 'Could not open previously deleted block.<br/>';
}
?>
 [2006-04-15 16:43 UTC] piotrprz at gmail dot com
PHP 5.1.2 still has this bug: apache2/php5.1.2 on windows xp
 [2007-07-13 20:55 UTC] jmccaskey at gmail dot com
I'm experiencing this same issue on PHP 5.2.2 under Apache 2 on windows.   How is it that this issue was opened years ago and is not fixed?
 [2007-07-18 04:01 UTC] sfox@php.net
Just noting two things: one, the patch is no longer online and two, Ilia doesn't really 'do' Windows any more.

I looked at it but don't have time to play right now, not least because I don't have a current copy of PHP on board. I _think_ it probably just needs a flag setting in shmctl() (in tsrm_win32.c) when it's called from shmop_delete() - not sure. Something like:

shm->descriptor->shm_perm.mode = IPC_EXCL;

- but again not sure, there's a copy flying around there somewhere. I'd need to test.
 [2008-06-07 02:58 UTC] pmvcallan at gmail dot com
Same problem running apache 2, php 5.2.6 on windows.

Attempted closing then deleting and deleting then closing the block, returns true in both cases.
Still leaves the block and contents intact regardless.
 [2010-10-17 19:28 UTC] felipe@php.net
-Status: Open +Status: Feedback
 [2010-10-17 19:28 UTC] felipe@php.net
Could you attach the patch in this report? Thanks.
 [2013-02-18 00:11 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.
 [2013-02-18 00:12 UTC] php-bugs at lists dot php dot net
No feedback was provided. The bug is being suspended because
we assume that you are no longer experiencing the problem.
If this is not the case and you are able to provide the
information that was requested earlier, please do so and
change the status of the bug back to "Open". Thank you.
 
PHP Copyright © 2001-2019 The PHP Group
All rights reserved.
Last updated: Mon Oct 21 15:01:27 2019 UTC