diff options
| author | Stanislav Malyshev <stas@php.net> | 2014-06-21 19:46:16 -0700 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2014-06-21 19:46:16 -0700 |
| commit | 88223c5245e9b470e1e6362bfd96829562ffe6ab (patch) | |
| tree | 010bbc13cd14925d468ef8d880b2105d0374e26b | |
| parent | 6027c56fd727d2c4b193b96fee19cdbb4a128447 (diff) | |
| download | php-git-88223c5245e9b470e1e6362bfd96829562ffe6ab.tar.gz | |
Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | ext/spl/spl_array.c | 2 | ||||
| -rw-r--r-- | ext/spl/spl_observer.c | 2 | ||||
| -rw-r--r-- | ext/spl/tests/SplObjectStorage_unserialize_bad.phpt | 5 |
4 files changed, 8 insertions, 3 deletions
@@ -53,6 +53,8 @@ PHP NEWS . Fixed bug #66127 (Segmentation fault with ArrayObject unset). (Stas) . Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence) . Fixed bug #67360 (Missing element after ArrayObject::getIterator). (Adam) + . Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type + Confusion). (Stefan Esser) 29 May 2014, PHP 5.4.29 diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 758947a8cc..bf034ab248 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1808,7 +1808,7 @@ SPL_METHOD(Array, unserialize) ++p; ALLOC_INIT_ZVAL(pmembers); - if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) { + if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) { zval_ptr_dtor(&pmembers); goto outexcept; } diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c index 1a706f7642..da9110bf14 100644 --- a/ext/spl/spl_observer.c +++ b/ext/spl/spl_observer.c @@ -898,7 +898,7 @@ SPL_METHOD(SplObjectStorage, unserialize) ++p; ALLOC_INIT_ZVAL(pmembers); - if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) { + if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) { zval_ptr_dtor(&pmembers); goto outexcept; } diff --git a/ext/spl/tests/SplObjectStorage_unserialize_bad.phpt b/ext/spl/tests/SplObjectStorage_unserialize_bad.phpt index a525317093..8f0676de3b 100644 --- a/ext/spl/tests/SplObjectStorage_unserialize_bad.phpt +++ b/ext/spl/tests/SplObjectStorage_unserialize_bad.phpt @@ -7,6 +7,7 @@ $badblobs = array( 'x:i:2;i:0;,i:1;;i:0;,i:2;;m:a:0:{}', 'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}', 'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}', +'x:i:1;O:8:"stdClass":0:{},N;;m:s:40:"1234567890123456789012345678901234567890"', ); foreach($badblobs as $blob) { try { @@ -17,6 +18,7 @@ try { echo $e->getMessage()."\n"; } } +echo "DONE\n"; --EXPECTF-- Error at offset 6 of 34 bytes Error at offset 46 of 89 bytes @@ -42,4 +44,5 @@ object(SplObjectStorage)#2 (1) { } } } - +Error at offset 79 of 78 bytes +DONE |