diff options
| author | Anatol Belski <ab@php.net> | 2016-01-04 17:52:37 +0100 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-01-05 13:34:14 +0100 |
| commit | 96963854819888980f388267a462a56826c07ced (patch) | |
| tree | cf18a74a1206d8360768f76d5c3e8bda08e17d5b | |
| parent | 6328074de3462cb5bcb0cb2446f7b6dae6c3f7fe (diff) | |
| download | php-git-96963854819888980f388267a462a56826c07ced.tar.gz | |
re-apply the patch from 1785d2b805f64eaaacf98c14c9e13107bf085ab1
too many conflicts to cherry-pick
| -rw-r--r-- | ext/wddx/tests/bug70741.phpt | 26 | ||||
| -rw-r--r-- | ext/wddx/wddx.c | 4 |
2 files changed, 30 insertions, 0 deletions
diff --git a/ext/wddx/tests/bug70741.phpt b/ext/wddx/tests/bug70741.phpt new file mode 100644 index 0000000000..9c7e09b48b --- /dev/null +++ b/ext/wddx/tests/bug70741.phpt @@ -0,0 +1,26 @@ +--TEST-- +Bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability) +--SKIPIF-- +<?php +if (!extension_loaded("wddx")) print "skip"; +?> +--FILE-- +<?php +ini_set('session.serialize_handler', 'wddx'); +session_start(); + +$hashtable = str_repeat('A', 66); +$wddx = "<?xml version='1.0'?> +<wddxPacket version='1.0'> +<header/> + <data> + <string>$hashtable</string> + </data> +</wddxPacket>"; +session_decode($wddx); +?> +DONE +--EXPECTF-- + +Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d +DONE
\ No newline at end of file diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index f6efa60fbe..c1027f76b5 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -298,6 +298,10 @@ PS_SERIALIZER_DECODE_FUNC(wddx) ZVAL_UNDEF(&retval); if ((ret = php_wddx_deserialize_ex(val, vallen, &retval)) == SUCCESS) { + if (Z_TYPE(retval) != IS_ARRAY) { + zval_dtor(&retval); + return FAILURE; + } ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(retval), idx, key, ent) { if (key == NULL) { key = zend_long_to_str(idx); |