Bug #77177 [Opn->Ver]: serializing a com() will cause a crash

From: Date: Mon, 19 Nov 2018 18:33:16 +0000
Subject: Bug #77177 [Opn->Ver]: serializing a com() will cause a crash
References: 1  Groups: php.bugs 
Request: Send a blank email to php-bugs+get-218052@lists.php.net to get a copy of this message 
Edit report at https://bugs.php.net/bug.php?id=77177&edit=1

 ID:                 77177
 Updated by:         cmb@php.net
 Reported by:        php at zsxsoft dot com
 Summary:            serializing a com() will cause a crash
-Status:             Open
+Status:             Verified
 Type:               Bug
 Package:            Reproducible crash
 Operating System:   Windows
-PHP Version:        Next Major Version
+PHP Version:        PHP 7.1.24
 Block user comment: N
 Private report:     N

 New Comment:

This also happens with older PHP versions.

Is an get_properties handler supposed to ever return NULL?


Previous Comments:
------------------------------------------------------------------------
[2018-11-19 16:38:20] php at zsxsoft dot com

Description:
------------
When try to serialize a class, serialize will try to get all properties of
the class by zend_get_properties_for. Then it will get the count of the properties by
zend_array_count without checking nullptr. 

com and com_safearray_proxy will always returns NULL in
com_properties_get so it will crash on zend_array_count.

Affect code
------------------------
ext/standard/var.c

static void php_var_serialize_intern(smart_str *buf, zval *struc, php_serialize_data_t var_hash) /*
{{{ */
[...]
incomplete_class = php_var_serialize_class_name(buf, struc);
myht = zend_get_properties_for(struc, ZEND_PROP_PURPOSE_SERIALIZE);
> i = zend_array_count(myht); // Crash here because myht == NULL
if (i > 0 && incomplete_class) {
  --i;
}


ext/com_dotnet/com_handlers.c

static HashTable *com_properties_get(zval *object)
{
	/* TODO: use type-info to get all the names and values ?
	 * DANGER: if we do that, there is a strong possibility for
	 * infinite recursion when the hash is displayed via var_dump().
	 * Perhaps it is best to leave it un-implemented.
	 */
	return NULL;
}



Test script:
---------------
<?php
$a = new COM("WScript.Shell");
serialize($a);

Expected result:
----------------
Nothing happened

Actual result:
--------------
Crash


------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=77177&edit=1

Thread (9 messages)

« previous php.bugs (#218052) next »