com php-src: Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion: ext/spl/spl_array.c ext/ spl/spl_observer.c
ext/spl/tests/SplObjectStorage_unser ialize_bad.phpt

Commit: c74efe1b2efd7222b27d36f383623cd19ed0e102 Author: Stanislav Malyshev <stas@php.net> Sat, 21 Jun 2014 19:46:16 -0700 Parents: b5051ff939eb9dbada8ce10fbea8cf37e50b5a36 Branches: PHP-5.3 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=c74efe1b2efd7222b27d36f383623cd19ed0e102 Log: Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion Conflicts: ext/spl/spl_array.c ext/spl/tests/SplObjectStorage_unserialize_bad.phpt Bugs: https://bugs.php.net/67492 Changed paths: M ext/spl/spl_array.c M ext/spl/spl_observer.c M ext/spl/tests/SplObjectStorage_unserialize_bad.phpt Diff: diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index f2f3f1c..312beaa 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1816,7 +1816,7 @@ void spl_array_unserialize_helper(spl_array_object *intern, const unsigned char ++p; ALLOC_INIT_ZVAL(pmembers); - if (!php_var_unserialize(&pmembers, &p, s + buf_len, var_hash_p TSRMLS_CC)) { + if (!php_var_unserialize(&pmembers, &p, s + buf_len, var_hash_p TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) { zval_ptr_dtor(&pmembers); goto outexcept; } diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c index 876efea..1a491e1 100644 --- a/ext/spl/spl_observer.c +++ b/ext/spl/spl_observer.c @@ -801,7 +801,7 @@ SPL_METHOD(SplObjectStorage, unserialize) ++p; ALLOC_INIT_ZVAL(pmembers); - if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) { + if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) { zval_ptr_dtor(&pmembers); goto outexcept; } diff --git a/ext/spl/tests/SplObjectStorage_unserialize_bad.phpt b/ext/spl/tests/SplObjectStorage_unserialize_bad.phpt index 9e3f360..4adfa6f 100644 --- a/ext/spl/tests/SplObjectStorage_unserialize_bad.phpt +++ b/ext/spl/tests/SplObjectStorage_unserialize_bad.phpt @@ -5,8 +5,9 @@ SPL: Test that serialized blob contains unique elements (CVE-2010-2225) $badblobs = array( 'x:i:2;i:0;,i:1;;i:0;,i:2;;m:a:0:{}', -'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:1;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}', -'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:1;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}', +'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}', +'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}', +'x:i:1;O:8:"stdClass":0:{},N;;m:s:40:"1234567890123456789012345678901234567890"', ); foreach($badblobs as $blob) { try { @@ -17,6 +18,7 @@ try { echo $e->getMessage()."\n"; } } +echo "DONE\n"; --EXPECTF-- Error at offset 6 of 34 bytes Error at offset 46 of 89 bytes @@ -42,4 +44,5 @@ object(SplObjectStorage)#2 (1) { } } } - +Error at offset 79 of 78 bytes +DONE