diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-23 13:18:39 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-23 13:18:39 +0200 |
| commit | f53af9ac2396f82fb9f69e668fbab7085de2f5b8 (patch) | |
| tree | e5b32ed206d540b12b84f54f41aa9956a00aa384 | |
| parent | e65adc9c190fbaadfc9cad044ee0a3cc5df15973 (diff) | |
| parent | 8509970e6a392de42b81882d7c81fa96a3c972e1 (diff) | |
| download | php-git-f53af9ac2396f82fb9f69e668fbab7085de2f5b8.tar.gz | |
Merge branch 'PHP-7.2' into PHP-7.3
| -rw-r--r-- | ext/spl/spl_observer.c | 3 | ||||
| -rw-r--r-- | ext/standard/tests/serialize/splobjectstorage_negative_count.phpt | 15 |
2 files changed, 18 insertions, 0 deletions
diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c index 212a53c206..c58a387e4c 100644 --- a/ext/spl/spl_observer.c +++ b/ext/spl/spl_observer.c @@ -783,6 +783,9 @@ SPL_METHOD(SplObjectStorage, unserialize) --p; /* for ';' */ count = Z_LVAL_P(pcount); + if (count < 0) { + goto outexcept; + } ZVAL_UNDEF(&entry); ZVAL_UNDEF(&inf); diff --git a/ext/standard/tests/serialize/splobjectstorage_negative_count.phpt b/ext/standard/tests/serialize/splobjectstorage_negative_count.phpt new file mode 100644 index 0000000000..4dda491a8b --- /dev/null +++ b/ext/standard/tests/serialize/splobjectstorage_negative_count.phpt @@ -0,0 +1,15 @@ +--TEST-- +OSS-Fuzz: Unserializing SplObjectStorage with negative number of elements +--FILE-- +<?php + +$str = 'C:16:"SplObjectStorage":25:{x:i:-9223372036854775808;}'; +try { + var_dump(unserialize($str)); +} catch (Exception $e) { + echo $e->getMessage(), "\n"; +} + +?> +--EXPECT-- +Error at offset 24 of 25 bytes |