com php-src: Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting): NEWS ext/spl/spl_array.c ext/spl/
tests/bug67539.phpt

Commit: 22882a9d89712ff2b6ebc20a689a89452bba4dcd Author: Xinchen Hui <laruence@php.net> Wed, 2 Jul 2014 17:57:42 +0800 Parents: df78c48354f376cf419d7a97f88ca07d572f00fb Branches: PHP-5.5 PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=22882a9d89712ff2b6ebc20a689a89452bba4dcd Log: Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting) Bugs: https://bugs.php.net/67539 Changed paths: M NEWS M ext/spl/spl_array.c A ext/spl/tests/bug67539.phpt Diff: diff --git a/NEWS b/NEWS index 7d23ec0..4a84854 100644 --- a/NEWS +++ b/NEWS @@ -22,6 +22,8 @@ PHP NEWS which affected builds against libpq < 7.3. (Adam) - SPL: + . Fixed bug #67539 (ArrayIterator use-after-free due to object change during + sorting). (research at insighti dot org, Laruence) . Fixed bug #67538 (SPL Iterators use-after-free). (Laruence) - Streams: diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 8392e72..0fe47b6 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1733,6 +1733,7 @@ SPL_METHOD(Array, unserialize) const unsigned char *p, *s; php_unserialize_data_t var_hash; zval *pmembers, *pflags = NULL; + HashTable *aht; long flags; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) { @@ -1744,6 +1745,12 @@ SPL_METHOD(Array, unserialize) return; } + aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + if (aht->nApplyCount > 0) { + zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); + return; + } + /* storage */ s = p = (const unsigned char*)buf; PHP_VAR_UNSERIALIZE_INIT(var_hash); diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt new file mode 100644 index 0000000..8bab2a8 --- /dev/null +++ b/ext/spl/tests/bug67539.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #67539 (ArrayIterator use-after-free due to object change during sorting) +--FILE-- +<?php + +$it = new ArrayIterator(array_fill(0,2,'X'), 1 ); + +function badsort($a, $b) { + $GLOBALS['it']->unserialize($GLOBALS['it']->serialize()); + return TRUE; +} + +$it->uksort('badsort'); +--EXPECTF-- +Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d