Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2:
  Fix GH-16591: Assertion error in shm_put_var

Author: nielsdos

NEWS

@@ -117,6 +117,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with
     bail enabled). (ilutov)
 
+- SysVShm:
+  . Fixed bug GH-16591 (Assertion error in shm_put_var). (nielsdos, cmb)
+
 - XMLReader:
   . Fixed bug GH-16292 (Segmentation fault in ext/xmlreader/php_xmlreader.c).
     (nielsdos)

ext/sysvshm/sysvshm.c

@@ -257,6 +257,12 @@ PHP_FUNCTION(shm_put_var)
 	php_var_serialize(&shm_var, arg_var, &var_hash);
 	PHP_VAR_SERIALIZE_DESTROY(var_hash);
 
+	if (UNEXPECTED(!shm_list_ptr->ptr)) {
+		smart_str_free(&shm_var);
+		zend_throw_error(NULL, "Shared memory block has been destroyed by the serialization function");
+		RETURN_THROWS();
+	}
+
 	/* insert serialized variable into shared memory */
 	ret = php_put_shm_data(shm_list_ptr->ptr, shm_key, shm_var.s? ZSTR_VAL(shm_var.s) : NULL, shm_var.s? ZSTR_LEN(shm_var.s) : 0);
 

ext/sysvshm/tests/gh16591.phpt

@@ -0,0 +1,25 @@
+--TEST--
+GH-16591 (Assertion error in shm_put_var)
+--EXTENSIONS--
+sysvshm
+--FILE--
+<?php
+
+class C {
+    function __serialize(): array {
+        global $mem;
+        shm_detach($mem);
+        return ['a' => 'b'];
+    }
+}
+
+$mem = shm_attach(1);
+try {
+    shm_put_var($mem, 1, new C);
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Shared memory block has been destroyed by the serialization function