diff options
| author | Stanislav Malyshev <stas@php.net> | 2015-09-01 00:20:45 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2015-09-01 00:20:45 -0700 |
| commit | 259057b2a484747a6c73ce54c4fa0f5acbd56179 (patch) | |
| tree | 42ac3a44a8f39e437c732e27cce80e43fae26da2 | |
| parent | f06a069c462d37c2e009f6d1d93b8c8e7b713393 (diff) | |
| download | php-git-259057b2a484747a6c73ce54c4fa0f5acbd56179.tar.gz | |
Fix bug #70366 - use-after-free vulnerability in unserialize() with SplDoublyLinkedList
| -rw-r--r-- | ext/spl/spl_dllist.c | 1 | ||||
| -rw-r--r-- | ext/spl/tests/bug70365.phpt | 2 | ||||
| -rw-r--r-- | ext/spl/tests/bug70366.phpt | 54 |
3 files changed, 56 insertions, 1 deletions
diff --git a/ext/spl/spl_dllist.c b/ext/spl/spl_dllist.c index 011d7a6e3c..ebe61c3f7a 100644 --- a/ext/spl/spl_dllist.c +++ b/ext/spl/spl_dllist.c @@ -1221,6 +1221,7 @@ SPL_METHOD(SplDoublyLinkedList, unserialize) zval_ptr_dtor(&elem); goto error; } + var_push_dtor(&var_hash, &elem); spl_ptr_llist_push(intern->llist, elem TSRMLS_CC); } diff --git a/ext/spl/tests/bug70365.phpt b/ext/spl/tests/bug70365.phpt index bd57360d3a..c18110e3ca 100644 --- a/ext/spl/tests/bug70365.phpt +++ b/ext/spl/tests/bug70365.phpt @@ -1,5 +1,5 @@ --TEST-- -SPL: Bug #70365 yet another use-after-free vulnerability in unserialize() with SplObjectStorage +SPL: Bug #70365 use-after-free vulnerability in unserialize() with SplObjectStorage --FILE-- <?php class obj { diff --git a/ext/spl/tests/bug70366.phpt b/ext/spl/tests/bug70366.phpt new file mode 100644 index 0000000000..c9aa584ae2 --- /dev/null +++ b/ext/spl/tests/bug70366.phpt @@ -0,0 +1,54 @@ +--TEST-- +SPL: Bug #70366 use-after-free vulnerability in unserialize() with SplDoublyLinkedList +--FILE-- +<?php +class obj { + var $ryat; + function __wakeup() { + $this->ryat = 1; + } +} + +$fakezval = ptr2str(1122334455); +$fakezval .= ptr2str(0); +$fakezval .= "\x00\x00\x00\x00"; +$fakezval .= "\x01"; +$fakezval .= "\x00"; +$fakezval .= "\x00\x00"; + +$inner = 'i:1234;:i:1;'; +$exploit = 'a:5:{i:0;i:1;i:1;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;a:1:{i:0;R:5;}i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}'; + +$data = unserialize($exploit); + +var_dump($data); + +function ptr2str($ptr) +{ + $out = ''; + for ($i = 0; $i < 8; $i++) { + $out .= chr($ptr & 0xff); + $ptr >>= 8; + } + return $out; +} +?> +--EXPECTF-- +array(5) { + [0]=> + int(1) + [1]=> + &int(1) + [2]=> + object(obj)#%d (1) { + ["ryat"]=> + &int(1) + } + [3]=> + array(1) { + [0]=> + int(1) + } + [4]=> + string(24) "%s" +}
\ No newline at end of file |