From 959c64a716efc52a1b0cc7ea15e20f115ab7127f Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 26 Oct 2024 12:24:28 +0200
Subject: [PATCH] Fix GH-16591: Assertion error in shm_put_var

Suggested-by: "Christoph M. Becker" <cmbecker69@gmx.de>
---
 ext/sysvshm/sysvshm.c          |  6 ++++++
 ext/sysvshm/tests/gh16591.phpt | 25 +++++++++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 ext/sysvshm/tests/gh16591.phpt

diff --git a/ext/sysvshm/sysvshm.c b/ext/sysvshm/sysvshm.c
index 717c75337bb66..2339a85476c15 100644
--- a/ext/sysvshm/sysvshm.c
+++ b/ext/sysvshm/sysvshm.c
@@ -257,6 +257,12 @@ PHP_FUNCTION(shm_put_var)
 	php_var_serialize(&shm_var, arg_var, &var_hash);
 	PHP_VAR_SERIALIZE_DESTROY(var_hash);
 
+	if (UNEXPECTED(!shm_list_ptr->ptr)) {
+		smart_str_free(&shm_var);
+		zend_throw_error(NULL, "Shared memory block has been destroyed by the serialization function");
+		RETURN_THROWS();
+	}
+
 	/* insert serialized variable into shared memory */
 	ret = php_put_shm_data(shm_list_ptr->ptr, shm_key, shm_var.s? ZSTR_VAL(shm_var.s) : NULL, shm_var.s? ZSTR_LEN(shm_var.s) : 0);
 
diff --git a/ext/sysvshm/tests/gh16591.phpt b/ext/sysvshm/tests/gh16591.phpt
new file mode 100644
index 0000000000000..d3ece7cd796aa
--- /dev/null
+++ b/ext/sysvshm/tests/gh16591.phpt
@@ -0,0 +1,25 @@
+--TEST--
+GH-16591 (Assertion error in shm_put_var)
+--EXTENSIONS--
+sysvshm
+--FILE--
+<?php
+
+class C {
+    function __serialize(): array {
+        global $mem;
+        shm_detach($mem);
+        return ['a' => 'b'];
+    }
+}
+
+$mem = shm_attach(1);
+try {
+    shm_put_var($mem, 1, new C);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Shared memory block has been destroyed by the serialization function