Bug #77177 [PATCH]: Serializing or unserializing COM objects crashes
Edit report at https://bugs.php.net/bug.php?id=77177&edit=1
ID: 77177
Patch added by: dadaguo@126.com
Reported by: php at zsxsoft dot com
Summary: Serializing or unserializing COM objects crashes
Status: Closed
Type: Bug
Package: Reproducible crash
Operating System: Windows
PHP Version: PHP 7.1.24
Block user comment: N
Private report: N
New Comment:
The following patch has been added/updated:
Patch Name: newtest0292
Revision: 1579365045
URL: https://bugs.php.net/patch-display.php?bug=77177&patch=newtest0292&revision=1579365045
Previous Comments:
------------------------------------------------------------------------
[2018-11-23 15:37:59] cmb@php.net
Automatic comment on behalf of cmbecker69@gmx.de
Revision: http://git.php.net/?p=php-src.git;a=commit;h=115ee49b0be12e3df7d2c7027609fbe1a1297e42
Log: Fix #77177: Serializing or unserializing COM objects crashes
------------------------------------------------------------------------
[2018-11-20 00:53:26] php at zsxsoft dot com
After fuzzing, I found unserialize those classes can crash php:
- variant
- com
- dotnet
unserialize('O:7:"variant":0:{}');
unserialize('O:3:"com":0:{}');
unserialize('O:6:"dotnet":0:{}');
------------------------------------------------------------------------
[2018-11-20 00:40:33] php at zsxsoft dot com
Unserialize a com will cause a crash too.
------------------------------------------------------------------------
[2018-11-20 00:37:57] php at zsxsoft dot com
Also, unserialize a com will cause a crash too.
I reviewed the git blame and found this bug can effect from PHP 5.0RC1RC1 to branch master: https://github.com/php/php-src/blob/6df5d5ba202b531de6bb563e2462e046d701e8d6/ext/com_dotnet/com_handlers.c#L264.
Effected code
---------
ext/standard/var_unserializer.c
static inline int object_common2(UNSERIALIZE_PARAMETER, zend_long elements)
ht = Z_OBJPROP_P(rval);
if (elements >= (zend_long)(HT_MAX_SIZE - zend_hash_num_elements(ht))) {
return 0;
}
Code
---------
<?php
$c = unserialize('O:3:"com":0:{}');
------------------------------------------------------------------------
[2018-11-19 18:33:16] cmb@php.net
This also happens with older PHP versions.
Is an get_properties handler supposed to ever return NULL?
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=77177
--
Edit this bug report at https://bugs.php.net/bug.php?id=77177&edit=1
Thread (9 messages)