com php-src: Merge branch 'PHP-5.4' into PHP-5.5: ext/standard/ var_unserializer.c ext/standard/var_unserializer.re

Commit: d5e523f52fd219e3143392f27c1449db65a1dbc1 Author: Stanislav Malyshev <stas@php.net> Tue, 17 Mar 2015 13:22:12 -0700 Parents: 3dfccd7ba5a9ef88f3c40b710010a4e4ba2e662e 646572d6d3847d68124b03936719f60936b49a38 Branches: PHP-5.5 PHP-5.6 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d5e523f52fd219e3143392f27c1449db65a1dbc1 Log: Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: Fixed bug #68976 - Use After Free Vulnerability in unserialize() Conflicts: ext/standard/var_unserializer.c Bugs: https://bugs.php.net/68976 Changed paths: MM ext/standard/var_unserializer.c MM ext/standard/var_unserializer.re

diff --cc ext/standard/var_unserializer.c index f99ba16,ee0cac4..188d2da --- a/ext/standard/var_unserializer.c +++ b/ext/standard/var_unserializer.c @@@ -1,4 -1,4 +1,4 @@@ - /* Generated by re2c 0.13.5 */ -/* Generated by re2c 0.13.7.5 on Tue Mar 17 13:14:30 2015 */ ++/* Generated by re2c 0.13.7.5 */ #line 1 "ext/standard/var_unserializer.re" /* +----------------------------------------------------------------------+ @@@ -482,7 -484,7 +483,7 @@@ PHPAPI int php_var_unserialize(UNSERIAL - #line 486 "ext/standard/var_unserializer.c" -#line 488 "ext/standard/var_unserializer.c" ++#line 487 "ext/standard/var_unserializer.c" { YYCTYPE yych; static const unsigned char yybm[] = { @@@ -542,9 -544,9 +543,9 @@@ yy2 yych = *(YYMARKER = ++YYCURSOR); if (yych == ':') goto yy95; yy3: - #line 837 "ext/standard/var_unserializer.re" -#line 839 "ext/standard/var_unserializer.re" ++#line 838 "ext/standard/var_unserializer.re" { return 0; } - #line 548 "ext/standard/var_unserializer.c" -#line 550 "ext/standard/var_unserializer.c" ++#line 549 "ext/standard/var_unserializer.c" yy4: yych = *(YYMARKER = ++YYCURSOR); if (yych == ':') goto yy89; @@@ -587,13 -589,13 +588,13 @@@ yy13 goto yy3; yy14: ++YYCURSOR; - #line 831 "ext/standard/var_unserializer.re" -#line 833 "ext/standard/var_unserializer.re" ++#line 832 "ext/standard/var_unserializer.re" { /* this is the case where we have less data than planned */ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data"); return 0; /* not sure if it should be 0 or 1 here? */ } - #line 597 "ext/standard/var_unserializer.c" -#line 599 "ext/standard/var_unserializer.c" ++#line 598 "ext/standard/var_unserializer.c" yy16: yych = *++YYCURSOR; goto yy3; @@@ -623,7 -626,7 +625,7 @@@ yy20 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 685 "ext/standard/var_unserializer.re" -#line 687 "ext/standard/var_unserializer.re" ++#line 686 "ext/standard/var_unserializer.re" { size_t len, len2, len3, maxlen; long elements; @@@ -769,7 -772,7 +771,7 @@@ return object_common2(UNSERIALIZE_PASSTHRU, elements); } - #line 773 "ext/standard/var_unserializer.c" -#line 776 "ext/standard/var_unserializer.c" ++#line 775 "ext/standard/var_unserializer.c" yy25: yych = *++YYCURSOR; if (yych <= ',') { @@@ -794,7 -797,7 +796,7 @@@ yy27 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 677 "ext/standard/var_unserializer.re" -#line 679 "ext/standard/var_unserializer.re" ++#line 678 "ext/standard/var_unserializer.re" { INIT_PZVAL(*rval); @@@ -802,7 -805,7 +804,7 @@@ return object_common2(UNSERIALIZE_PASSTHRU, object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); } - #line 806 "ext/standard/var_unserializer.c" -#line 809 "ext/standard/var_unserializer.c" ++#line 808 "ext/standard/var_unserializer.c" yy32: yych = *++YYCURSOR; if (yych == '+') goto yy33; @@@ -823,7 -826,7 +825,7 @@@ yy34 yych = *++YYCURSOR; if (yych != '{') goto yy18; ++YYCURSOR; - #line 657 "ext/standard/var_unserializer.re" -#line 659 "ext/standard/var_unserializer.re" ++#line 658 "ext/standard/var_unserializer.re" { long elements = parse_iv(start + 2); /* use iv() not uiv() in order to check data range */ @@@ -843,7 -846,7 +845,7 @@@ return finish_nested_data(UNSERIALIZE_PASSTHRU); } - #line 847 "ext/standard/var_unserializer.c" -#line 850 "ext/standard/var_unserializer.c" ++#line 849 "ext/standard/var_unserializer.c" yy39: yych = *++YYCURSOR; if (yych == '+') goto yy40; @@@ -864,7 -867,7 +866,7 @@@ yy41 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 628 "ext/standard/var_unserializer.re" -#line 630 "ext/standard/var_unserializer.re" ++#line 629 "ext/standard/var_unserializer.re" { size_t len, maxlen; char *str; @@@ -893,7 -896,7 +895,7 @@@ ZVAL_STRINGL(*rval, str, len, 0); return 1; } - #line 897 "ext/standard/var_unserializer.c" -#line 900 "ext/standard/var_unserializer.c" ++#line 899 "ext/standard/var_unserializer.c" yy46: yych = *++YYCURSOR; if (yych == '+') goto yy47; @@@ -914,7 -917,7 +916,7 @@@ yy48 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 600 "ext/standard/var_unserializer.re" -#line 602 "ext/standard/var_unserializer.re" ++#line 601 "ext/standard/var_unserializer.re" { size_t len, maxlen; char *str; @@@ -942,7 -945,7 +944,7 @@@ ZVAL_STRINGL(*rval, str, len, 1); return 1; } - #line 946 "ext/standard/var_unserializer.c" -#line 949 "ext/standard/var_unserializer.c" ++#line 948 "ext/standard/var_unserializer.c" yy53: yych = *++YYCURSOR; if (yych <= '/') { @@@ -1030,7 -1033,7 +1032,7 @@@ yy61 } yy63: ++YYCURSOR; - #line 590 "ext/standard/var_unserializer.re" -#line 592 "ext/standard/var_unserializer.re" ++#line 591 "ext/standard/var_unserializer.re" { #if SIZEOF_LONG == 4 use_double: @@@ -1040,7 -1043,7 +1042,7 @@@ ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL)); return 1; } - #line 1044 "ext/standard/var_unserializer.c" -#line 1047 "ext/standard/var_unserializer.c" ++#line 1046 "ext/standard/var_unserializer.c" yy65: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1099,7 -1102,7 +1101,7 @@@ yy73 yych = *++YYCURSOR; if (yych != ';') goto yy18; ++YYCURSOR; - #line 575 "ext/standard/var_unserializer.re" -#line 577 "ext/standard/var_unserializer.re" ++#line 576 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); @@@ -1114,7 -1117,7 +1116,7 @@@ return 1; } - #line 1118 "ext/standard/var_unserializer.c" -#line 1121 "ext/standard/var_unserializer.c" ++#line 1120 "ext/standard/var_unserializer.c" yy76: yych = *++YYCURSOR; if (yych == 'N') goto yy73; @@@ -1141,7 -1144,7 +1143,7 @@@ yy79 if (yych <= '9') goto yy79; if (yych != ';') goto yy18; ++YYCURSOR; - #line 548 "ext/standard/var_unserializer.re" -#line 550 "ext/standard/var_unserializer.re" ++#line 549 "ext/standard/var_unserializer.re" { #if SIZEOF_LONG == 4 int digits = YYCURSOR - start - 3; @@@ -1168,7 -1171,7 +1170,7 @@@ ZVAL_LONG(*rval, parse_iv(start + 2)); return 1; } - #line 1172 "ext/standard/var_unserializer.c" -#line 1175 "ext/standard/var_unserializer.c" ++#line 1174 "ext/standard/var_unserializer.c" yy83: yych = *++YYCURSOR; if (yych <= '/') goto yy18; @@@ -1176,24 -1179,24 +1178,24 @@@ yych = *++YYCURSOR; if (yych != ';') goto yy18; ++YYCURSOR; - #line 541 "ext/standard/var_unserializer.re" -#line 543 "ext/standard/var_unserializer.re" ++#line 542 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_BOOL(*rval, parse_iv(start + 2)); return 1; } - #line 1187 "ext/standard/var_unserializer.c" -#line 1190 "ext/standard/var_unserializer.c" ++#line 1189 "ext/standard/var_unserializer.c" yy87: ++YYCURSOR; - #line 534 "ext/standard/var_unserializer.re" -#line 536 "ext/standard/var_unserializer.re" ++#line 535 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_NULL(*rval); return 1; } - #line 1197 "ext/standard/var_unserializer.c" -#line 1200 "ext/standard/var_unserializer.c" ++#line 1199 "ext/standard/var_unserializer.c" yy89: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1216,7 -1219,7 +1218,7 @@@ yy91 if (yych <= '9') goto yy91; if (yych != ';') goto yy18; ++YYCURSOR; - #line 511 "ext/standard/var_unserializer.re" -#line 513 "ext/standard/var_unserializer.re" ++#line 512 "ext/standard/var_unserializer.re" { long id; @@@ -1239,7 -1242,7 +1241,7 @@@ return 1; } - #line 1243 "ext/standard/var_unserializer.c" -#line 1246 "ext/standard/var_unserializer.c" ++#line 1245 "ext/standard/var_unserializer.c" yy95: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1262,7 -1265,7 +1264,7 @@@ yy97 if (yych <= '9') goto yy97; if (yych != ';') goto yy18; ++YYCURSOR; - #line 490 "ext/standard/var_unserializer.re" -#line 492 "ext/standard/var_unserializer.re" ++#line 491 "ext/standard/var_unserializer.re" { long id; @@@ -1283,9 -1286,9 +1285,9 @@@ return 1; } - #line 1287 "ext/standard/var_unserializer.c" -#line 1290 "ext/standard/var_unserializer.c" ++#line 1289 "ext/standard/var_unserializer.c" } - #line 839 "ext/standard/var_unserializer.re" -#line 841 "ext/standard/var_unserializer.re" ++#line 840 "ext/standard/var_unserializer.re" return 0;