diff options
| author | Anatol Belski <ab@php.net> | 2016-01-04 17:52:37 +0100 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-01-04 17:52:37 +0100 |
| commit | cf1c50957b8169af01318df67bee42f8134cd708 (patch) | |
| tree | e5828ea8510f9a63c3832dcf3e0438280519cac1 | |
| parent | 82865dda71d436bc8a89f1e601ca6964f4cb54f5 (diff) | |
| download | php-git-cf1c50957b8169af01318df67bee42f8134cd708.tar.gz | |
re-apply the patch from 1785d2b805f64eaaacf98c14c9e13107bf085ab1
too many conflicts to cherry-pick
| -rw-r--r-- | ext/wddx/tests/bug70741.phpt | 26 | ||||
| -rw-r--r-- | ext/wddx/wddx.c | 4 |
2 files changed, 30 insertions, 0 deletions
diff --git a/ext/wddx/tests/bug70741.phpt b/ext/wddx/tests/bug70741.phpt new file mode 100644 index 0000000000..9c7e09b48b --- /dev/null +++ b/ext/wddx/tests/bug70741.phpt @@ -0,0 +1,26 @@ +--TEST-- +Bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability) +--SKIPIF-- +<?php +if (!extension_loaded("wddx")) print "skip"; +?> +--FILE-- +<?php +ini_set('session.serialize_handler', 'wddx'); +session_start(); + +$hashtable = str_repeat('A', 66); +$wddx = "<?xml version='1.0'?> +<wddxPacket version='1.0'> +<header/> + <data> + <string>$hashtable</string> + </data> +</wddxPacket>"; +session_decode($wddx); +?> +DONE +--EXPECTF-- + +Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d +DONE
\ No newline at end of file diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index 83b8f97294..c0971f8974 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -298,6 +298,10 @@ PS_SERIALIZER_DECODE_FUNC(wddx) ZVAL_UNDEF(&retval); if ((ret = php_wddx_deserialize_ex(val, vallen, &retval)) == SUCCESS) { + if (Z_TYPE(retval) != IS_ARRAY) { + zval_dtor(&retval); + return FAILURE; + } ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(retval), idx, key, ent) { if (key == NULL) { key = zend_long_to_str(idx); |