diff options
author | Stanislav Malyshev <stas@php.net> | 2015-03-17 13:20:22 -0700 |
---|---|---|
committer | Ferenc Kovacs <tyrael@php.net> | 2015-03-19 00:54:06 +0100 |
commit | 10198311a8a4f4d32988f0cce7d75b7e34f5ad38 (patch) | |
tree | c91780e44b91ed39a84a17fccaa5355099c83a18 | |
parent | ec779124cb7279493ce1ca1088d1aaa32e82479a (diff) | |
download | php-git-10198311a8a4f4d32988f0cce7d75b7e34f5ad38.tar.gz |
Fixed bug #68976 - Use After Free Vulnerability in unserialize()
-rw-r--r-- | ext/standard/var_unserializer.c | 66 | ||||
-rw-r--r-- | ext/standard/var_unserializer.re | 1 |
2 files changed, 35 insertions, 32 deletions
diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c index 26e532ac43..ac17529c20 100644 --- a/ext/standard/var_unserializer.c +++ b/ext/standard/var_unserializer.c @@ -1,4 +1,4 @@ -/* Generated by re2c 0.13.5 */ +/* Generated by re2c 0.13.7.5 */ #line 1 "ext/standard/var_unserializer.re" /* +----------------------------------------------------------------------+ @@ -347,6 +347,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof data, NULL); } + var_push_dtor(var_hash, &data); zval_dtor(key); FREE_ZVAL(key); @@ -477,7 +478,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER) -#line 481 "ext/standard/var_unserializer.c" +#line 482 "ext/standard/var_unserializer.c" { YYCTYPE yych; static const unsigned char yybm[] = { @@ -537,9 +538,9 @@ yy2: yych = *(YYMARKER = ++YYCURSOR); if (yych == ':') goto yy95; yy3: -#line 832 "ext/standard/var_unserializer.re" +#line 833 "ext/standard/var_unserializer.re" { return 0; } -#line 543 "ext/standard/var_unserializer.c" +#line 544 "ext/standard/var_unserializer.c" yy4: yych = *(YYMARKER = ++YYCURSOR); if (yych == ':') goto yy89; @@ -582,13 +583,13 @@ yy13: goto yy3; yy14: ++YYCURSOR; -#line 826 "ext/standard/var_unserializer.re" +#line 827 "ext/standard/var_unserializer.re" { /* this is the case where we have less data than planned */ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data"); return 0; /* not sure if it should be 0 or 1 here? */ } -#line 592 "ext/standard/var_unserializer.c" +#line 593 "ext/standard/var_unserializer.c" yy16: yych = *++YYCURSOR; goto yy3; @@ -614,11 +615,12 @@ yy20: if (yybm[0+yych] & 128) { goto yy20; } - if (yych != ':') goto yy18; + if (yych <= '/') goto yy18; + if (yych >= ';') goto yy18; yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; -#line 680 "ext/standard/var_unserializer.re" +#line 681 "ext/standard/var_unserializer.re" { size_t len, len2, len3, maxlen; long elements; @@ -764,7 +766,7 @@ yy20: return object_common2(UNSERIALIZE_PASSTHRU, elements); } -#line 768 "ext/standard/var_unserializer.c" +#line 770 "ext/standard/var_unserializer.c" yy25: yych = *++YYCURSOR; if (yych <= ',') { @@ -789,7 +791,7 @@ yy27: yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; -#line 672 "ext/standard/var_unserializer.re" +#line 673 "ext/standard/var_unserializer.re" { INIT_PZVAL(*rval); @@ -797,7 +799,7 @@ yy27: return object_common2(UNSERIALIZE_PASSTHRU, object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); } -#line 801 "ext/standard/var_unserializer.c" +#line 803 "ext/standard/var_unserializer.c" yy32: yych = *++YYCURSOR; if (yych == '+') goto yy33; @@ -818,7 +820,7 @@ yy34: yych = *++YYCURSOR; if (yych != '{') goto yy18; ++YYCURSOR; -#line 652 "ext/standard/var_unserializer.re" +#line 653 "ext/standard/var_unserializer.re" { long elements = parse_iv(start + 2); /* use iv() not uiv() in order to check data range */ @@ -838,7 +840,7 @@ yy34: return finish_nested_data(UNSERIALIZE_PASSTHRU); } -#line 842 "ext/standard/var_unserializer.c" +#line 844 "ext/standard/var_unserializer.c" yy39: yych = *++YYCURSOR; if (yych == '+') goto yy40; @@ -859,7 +861,7 @@ yy41: yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; -#line 623 "ext/standard/var_unserializer.re" +#line 624 "ext/standard/var_unserializer.re" { size_t len, maxlen; char *str; @@ -888,7 +890,7 @@ yy41: ZVAL_STRINGL(*rval, str, len, 0); return 1; } -#line 892 "ext/standard/var_unserializer.c" +#line 894 "ext/standard/var_unserializer.c" yy46: yych = *++YYCURSOR; if (yych == '+') goto yy47; @@ -909,7 +911,7 @@ yy48: yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; -#line 595 "ext/standard/var_unserializer.re" +#line 596 "ext/standard/var_unserializer.re" { size_t len, maxlen; char *str; @@ -937,7 +939,7 @@ yy48: ZVAL_STRINGL(*rval, str, len, 1); return 1; } -#line 941 "ext/standard/var_unserializer.c" +#line 943 "ext/standard/var_unserializer.c" yy53: yych = *++YYCURSOR; if (yych <= '/') { @@ -1025,7 +1027,7 @@ yy61: } yy63: ++YYCURSOR; -#line 585 "ext/standard/var_unserializer.re" +#line 586 "ext/standard/var_unserializer.re" { #if SIZEOF_LONG == 4 use_double: @@ -1035,7 +1037,7 @@ use_double: ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL)); return 1; } -#line 1039 "ext/standard/var_unserializer.c" +#line 1041 "ext/standard/var_unserializer.c" yy65: yych = *++YYCURSOR; if (yych <= ',') { @@ -1094,7 +1096,7 @@ yy73: yych = *++YYCURSOR; if (yych != ';') goto yy18; ++YYCURSOR; -#line 570 "ext/standard/var_unserializer.re" +#line 571 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); @@ -1109,7 +1111,7 @@ yy73: return 1; } -#line 1113 "ext/standard/var_unserializer.c" +#line 1115 "ext/standard/var_unserializer.c" yy76: yych = *++YYCURSOR; if (yych == 'N') goto yy73; @@ -1136,7 +1138,7 @@ yy79: if (yych <= '9') goto yy79; if (yych != ';') goto yy18; ++YYCURSOR; -#line 543 "ext/standard/var_unserializer.re" +#line 544 "ext/standard/var_unserializer.re" { #if SIZEOF_LONG == 4 int digits = YYCURSOR - start - 3; @@ -1163,7 +1165,7 @@ yy79: ZVAL_LONG(*rval, parse_iv(start + 2)); return 1; } -#line 1167 "ext/standard/var_unserializer.c" +#line 1169 "ext/standard/var_unserializer.c" yy83: yych = *++YYCURSOR; if (yych <= '/') goto yy18; @@ -1171,24 +1173,24 @@ yy83: yych = *++YYCURSOR; if (yych != ';') goto yy18; ++YYCURSOR; -#line 536 "ext/standard/var_unserializer.re" +#line 537 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_BOOL(*rval, parse_iv(start + 2)); return 1; } -#line 1182 "ext/standard/var_unserializer.c" +#line 1184 "ext/standard/var_unserializer.c" yy87: ++YYCURSOR; -#line 529 "ext/standard/var_unserializer.re" +#line 530 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_NULL(*rval); return 1; } -#line 1192 "ext/standard/var_unserializer.c" +#line 1194 "ext/standard/var_unserializer.c" yy89: yych = *++YYCURSOR; if (yych <= ',') { @@ -1211,7 +1213,7 @@ yy91: if (yych <= '9') goto yy91; if (yych != ';') goto yy18; ++YYCURSOR; -#line 506 "ext/standard/var_unserializer.re" +#line 507 "ext/standard/var_unserializer.re" { long id; @@ -1234,7 +1236,7 @@ yy91: return 1; } -#line 1238 "ext/standard/var_unserializer.c" +#line 1240 "ext/standard/var_unserializer.c" yy95: yych = *++YYCURSOR; if (yych <= ',') { @@ -1257,7 +1259,7 @@ yy97: if (yych <= '9') goto yy97; if (yych != ';') goto yy18; ++YYCURSOR; -#line 485 "ext/standard/var_unserializer.re" +#line 486 "ext/standard/var_unserializer.re" { long id; @@ -1278,9 +1280,9 @@ yy97: return 1; } -#line 1282 "ext/standard/var_unserializer.c" +#line 1284 "ext/standard/var_unserializer.c" } -#line 834 "ext/standard/var_unserializer.re" +#line 835 "ext/standard/var_unserializer.re" return 0; diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re index fe019fb93d..295acc55c4 100644 --- a/ext/standard/var_unserializer.re +++ b/ext/standard/var_unserializer.re @@ -351,6 +351,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data, sizeof data, NULL); } + var_push_dtor(var_hash, &data); zval_dtor(key); FREE_ZVAL(key); |