com php-src: Fix crashes in GMP serialize/unserialize: NEWS ext/gmp/gmp.c

Commit: c18ae51aebfcdf4564aa87d4d24c3046bbe9ade6 Author: Stanislav Malyshev <stas@php.net> Mon, 28 Apr 2014 01:01:54 -0700 Parents: 3842417289a9088504e2e247037d67f7dd31391d Branches: PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=c18ae51aebfcdf4564aa87d4d24c3046bbe9ade6 Log: Fix crashes in GMP serialize/unserialize Changed paths: M NEWS M ext/gmp/gmp.c Diff: diff --git a/NEWS b/NEWS index 9303dd6..6caa01e 100644 --- a/NEWS +++ b/NEWS @@ -43,6 +43,9 @@ PHP NEWS . Fixed bug #66908 (php-fpm reload leaks epoll_create() file descriptor). (Julio Pintos) +- GMP: + . Fixed crashes in serialize/unserialize. (Stas) + - JSON: . Fixed bug #66021 (Blank line inside empty array/object when JSON_PRETTY_PRINT is set). (Kevin Israel) diff --git a/ext/gmp/gmp.c b/ext/gmp/gmp.c index d34d78f..cd50896 100644 --- a/ext/gmp/gmp.c +++ b/ext/gmp/gmp.c @@ -575,22 +575,20 @@ static int gmp_serialize(zval *object, unsigned char **buffer, zend_uint *buf_le mpz_ptr gmpnum = GET_GMP_FROM_ZVAL(object); smart_str buf = {0}; zval zv, *zv_ptr = &zv; - php_serialize_data_t *serialize_data = (php_serialize_data_t *) data; - - PHP_VAR_SERIALIZE_INIT(*serialize_data); + php_serialize_data_t serialize_data = (php_serialize_data_t) data; + PHP_VAR_SERIALIZE_INIT(serialize_data); INIT_PZVAL(zv_ptr); - + gmp_strval(zv_ptr, gmpnum, 10); - php_var_serialize(&buf, &zv_ptr, serialize_data TSRMLS_CC); + php_var_serialize(&buf, &zv_ptr, &serialize_data TSRMLS_CC); zval_dtor(zv_ptr); Z_ARRVAL_P(zv_ptr) = zend_std_get_properties(object TSRMLS_CC); Z_TYPE_P(zv_ptr) = IS_ARRAY; - php_var_serialize(&buf, &zv_ptr, serialize_data TSRMLS_CC); - - PHP_VAR_SERIALIZE_DESTROY(*serialize_data); + php_var_serialize(&buf, &zv_ptr, &serialize_data TSRMLS_CC); + PHP_VAR_SERIALIZE_DESTROY(serialize_data); *buffer = (unsigned char *) buf.c; *buf_len = buf.len; @@ -604,17 +602,16 @@ static int gmp_unserialize(zval **object, zend_class_entry *ce, const unsigned c const unsigned char *p, *max; zval zv, *zv_ptr = &zv; int retval = FAILURE; - php_unserialize_data_t *unserialize_data = (php_unserialize_data_t *) data; - - PHP_VAR_UNSERIALIZE_INIT(*unserialize_data); + php_unserialize_data_t unserialize_data = (php_unserialize_data_t) data; + PHP_VAR_UNSERIALIZE_INIT(unserialize_data); gmp_create_ex(*object, &gmpnum TSRMLS_CC); p = buf; max = buf + buf_len; INIT_ZVAL(zv); - if (!php_var_unserialize(&zv_ptr, &p, max, unserialize_data TSRMLS_CC) + if (!php_var_unserialize(&zv_ptr, &p, max, &unserialize_data TSRMLS_CC) || Z_TYPE_P(zv_ptr) != IS_STRING || convert_to_gmp(gmpnum, zv_ptr, 10 TSRMLS_CC) == FAILURE ) { @@ -624,7 +621,7 @@ static int gmp_unserialize(zval **object, zend_class_entry *ce, const unsigned c zval_dtor(&zv); INIT_ZVAL(zv); - if (!php_var_unserialize(&zv_ptr, &p, max, unserialize_data TSRMLS_CC) + if (!php_var_unserialize(&zv_ptr, &p, max, &unserialize_data TSRMLS_CC) || Z_TYPE_P(zv_ptr) != IS_ARRAY ) { zend_throw_exception(NULL, "Could not unserialize properties", 0 TSRMLS_CC); @@ -641,7 +638,7 @@ static int gmp_unserialize(zval **object, zend_class_entry *ce, const unsigned c retval = SUCCESS; exit: zval_dtor(&zv); - PHP_VAR_UNSERIALIZE_DESTROY(*unserialize_data); + PHP_VAR_UNSERIALIZE_DESTROY(unserialize_data); return retval; } /* }}} */