Bug #77177 [NEW]: serializing a com() will cause a crash
From: php at zsxsoft dot com
Operating system: Windows
PHP version: Next Major Version
Package: Reproducible crash
Bug Type: Bug
Bug description:serializing a com() will cause a crash
Description:
------------
When try to serialize a class, serialize will try to get all
properties of the class by zend_get_properties_for. Then it will get
the count of the properties by zend_array_count without checking
nullptr.
com and com_safearray_proxy will always returns NULL in
com_properties_get so it will crash on zend_array_count.
Affect code
------------------------
ext/standard/var.c
static void php_var_serialize_intern(smart_str *buf, zval *struc,
php_serialize_data_t var_hash) /* {{{ */
[...]
incomplete_class = php_var_serialize_class_name(buf, struc);
myht = zend_get_properties_for(struc, ZEND_PROP_PURPOSE_SERIALIZE);
> i = zend_array_count(myht); // Crash here because myht == NULL
if (i > 0 && incomplete_class) {
--i;
}
ext/com_dotnet/com_handlers.c
static HashTable *com_properties_get(zval *object)
{
/* TODO: use type-info to get all the names and values ?
* DANGER: if we do that, there is a strong possibility for
* infinite recursion when the hash is displayed via var_dump().
* Perhaps it is best to leave it un-implemented.
*/
return NULL;
}
Test script:
---------------
<?php
$a = new COM("WScript.Shell");
serialize($a);
Expected result:
----------------
Nothing happened
Actual result:
--------------
Crash
--
Edit bug report at https://bugs.php.net/bug.php?id=77177&edit=1
--
Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=77177&r=trysnapshot54
Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=77177&r=trysnapshot55
Try a snapshot (trunk): https://bugs.php.net/fix.php?id=77177&r=trysnapshottrunk
Fixed in SVN: https://bugs.php.net/fix.php?id=77177&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=77177&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=77177&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=77177&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=77177&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=77177&r=support
Expected behavior: https://bugs.php.net/fix.php?id=77177&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=77177&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=77177&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=77177&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=77177&r=php4
Daylight Savings: https://bugs.php.net/fix.php?id=77177&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=77177&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=77177&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=77177&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=77177&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=77177&r=mysqlcfg
Thread (9 messages)
- php at zsxsoft dot com