com php-src: Merge branch 'PHP-5.5' into PHP-5.6: ext/standard/ var_unserializer.c ext/standard/var_unserializer.re
| From: | Stanislav Malyshev | Date: | Tue, 17 Mar 2015 20:23:51 +0000 |
| Subject: | com php-src: Merge branch 'PHP-5.5' into PHP-5.6: ext/standard/ var_unserializer.c ext/standard/var_unserializer.re | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-85574@lists.php.net to get a copy of this message | ||
Commit: 33a5532b66712884ca25897e7ffebfb890fba2f0
Author: Stanislav Malyshev <stas@php.net> Tue, 17 Mar 2015 13:23:51 -0700
Parents: 3d00867bbace3a500f6ff595be9c07eea073f28b d5e523f52fd219e3143392f27c1449db65a1dbc1
Branches: PHP-5.6
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=33a5532b66712884ca25897e7ffebfb890fba2f0
Log:
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5:
Fixed bug #68976 - Use After Free Vulnerability in unserialize()
Conflicts:
ext/standard/var_unserializer.c
Bugs:
https://bugs.php.net/68976
Changed paths:
MM ext/standard/var_unserializer.c
MM ext/standard/var_unserializer.re
diff --cc ext/standard/var_unserializer.c index 26e532a,188d2da..ac17529 --- a/ext/standard/var_unserializer.c +++ b/ext/standard/var_unserializer.c @@@ -477,7 -483,7 +478,7 @@@ PHPAPI int php_var_unserialize(UNSERIAL - #line 481 "ext/standard/var_unserializer.c" -#line 487 "ext/standard/var_unserializer.c" ++#line 482 "ext/standard/var_unserializer.c" { YYCTYPE yych; static const unsigned char yybm[] = { @@@ -537,9 -543,9 +538,9 @@@ yy2 yych = *(YYMARKER = ++YYCURSOR); if (yych == ':') goto yy95; yy3: - #line 832 "ext/standard/var_unserializer.re" -#line 838 "ext/standard/var_unserializer.re" ++#line 833 "ext/standard/var_unserializer.re" { return 0; } - #line 543 "ext/standard/var_unserializer.c" -#line 549 "ext/standard/var_unserializer.c" ++#line 544 "ext/standard/var_unserializer.c" yy4: yych = *(YYMARKER = ++YYCURSOR); if (yych == ':') goto yy89; @@@ -582,13 -588,13 +583,13 @@@ yy13 goto yy3; yy14: ++YYCURSOR; - #line 826 "ext/standard/var_unserializer.re" -#line 832 "ext/standard/var_unserializer.re" ++#line 827 "ext/standard/var_unserializer.re" { /* this is the case where we have less data than planned */ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data"); return 0; /* not sure if it should be 0 or 1 here? */ } - #line 592 "ext/standard/var_unserializer.c" -#line 598 "ext/standard/var_unserializer.c" ++#line 593 "ext/standard/var_unserializer.c" yy16: yych = *++YYCURSOR; goto yy3; @@@ -618,7 -625,7 +620,7 @@@ yy20 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 680 "ext/standard/var_unserializer.re" -#line 686 "ext/standard/var_unserializer.re" ++#line 681 "ext/standard/var_unserializer.re" { size_t len, len2, len3, maxlen; long elements; @@@ -764,7 -771,7 +766,7 @@@ return object_common2(UNSERIALIZE_PASSTHRU, elements); } - #line 768 "ext/standard/var_unserializer.c" -#line 775 "ext/standard/var_unserializer.c" ++#line 770 "ext/standard/var_unserializer.c" yy25: yych = *++YYCURSOR; if (yych <= ',') { @@@ -789,7 -796,7 +791,7 @@@ yy27 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 672 "ext/standard/var_unserializer.re" -#line 678 "ext/standard/var_unserializer.re" ++#line 673 "ext/standard/var_unserializer.re" { INIT_PZVAL(*rval); @@@ -797,7 -804,7 +799,7 @@@ return object_common2(UNSERIALIZE_PASSTHRU, object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); } - #line 801 "ext/standard/var_unserializer.c" -#line 808 "ext/standard/var_unserializer.c" ++#line 803 "ext/standard/var_unserializer.c" yy32: yych = *++YYCURSOR; if (yych == '+') goto yy33; @@@ -818,7 -825,7 +820,7 @@@ yy34 yych = *++YYCURSOR; if (yych != '{') goto yy18; ++YYCURSOR; - #line 652 "ext/standard/var_unserializer.re" -#line 658 "ext/standard/var_unserializer.re" ++#line 653 "ext/standard/var_unserializer.re" { long elements = parse_iv(start + 2); /* use iv() not uiv() in order to check data range */ @@@ -838,7 -845,7 +840,7 @@@ return finish_nested_data(UNSERIALIZE_PASSTHRU); } - #line 842 "ext/standard/var_unserializer.c" -#line 849 "ext/standard/var_unserializer.c" ++#line 844 "ext/standard/var_unserializer.c" yy39: yych = *++YYCURSOR; if (yych == '+') goto yy40; @@@ -859,7 -866,7 +861,7 @@@ yy41 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 623 "ext/standard/var_unserializer.re" -#line 629 "ext/standard/var_unserializer.re" ++#line 624 "ext/standard/var_unserializer.re" { size_t len, maxlen; char *str; @@@ -888,7 -895,7 +890,7 @@@ ZVAL_STRINGL(*rval, str, len, 0); return 1; } - #line 892 "ext/standard/var_unserializer.c" -#line 899 "ext/standard/var_unserializer.c" ++#line 894 "ext/standard/var_unserializer.c" yy46: yych = *++YYCURSOR; if (yych == '+') goto yy47; @@@ -909,7 -916,7 +911,7 @@@ yy48 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 595 "ext/standard/var_unserializer.re" -#line 601 "ext/standard/var_unserializer.re" ++#line 596 "ext/standard/var_unserializer.re" { size_t len, maxlen; char *str; @@@ -937,7 -944,7 +939,7 @@@ ZVAL_STRINGL(*rval, str, len, 1); return 1; } - #line 941 "ext/standard/var_unserializer.c" -#line 948 "ext/standard/var_unserializer.c" ++#line 943 "ext/standard/var_unserializer.c" yy53: yych = *++YYCURSOR; if (yych <= '/') { @@@ -1025,7 -1032,7 +1027,7 @@@ yy61 } yy63: ++YYCURSOR; - #line 585 "ext/standard/var_unserializer.re" -#line 591 "ext/standard/var_unserializer.re" ++#line 586 "ext/standard/var_unserializer.re" { #if SIZEOF_LONG == 4 use_double: @@@ -1035,7 -1042,7 +1037,7 @@@ ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL)); return 1; } - #line 1039 "ext/standard/var_unserializer.c" -#line 1046 "ext/standard/var_unserializer.c" ++#line 1041 "ext/standard/var_unserializer.c" yy65: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1094,7 -1101,7 +1096,7 @@@ yy73 yych = *++YYCURSOR; if (yych != ';') goto yy18; ++YYCURSOR; - #line 570 "ext/standard/var_unserializer.re" -#line 576 "ext/standard/var_unserializer.re" ++#line 571 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); @@@ -1109,7 -1116,7 +1111,7 @@@ return 1; } - #line 1113 "ext/standard/var_unserializer.c" -#line 1120 "ext/standard/var_unserializer.c" ++#line 1115 "ext/standard/var_unserializer.c" yy76: yych = *++YYCURSOR; if (yych == 'N') goto yy73; @@@ -1136,7 -1143,7 +1138,7 @@@ yy79 if (yych <= '9') goto yy79; if (yych != ';') goto yy18; ++YYCURSOR; - #line 543 "ext/standard/var_unserializer.re" -#line 549 "ext/standard/var_unserializer.re" ++#line 544 "ext/standard/var_unserializer.re" { #if SIZEOF_LONG == 4 int digits = YYCURSOR - start - 3; @@@ -1163,7 -1170,7 +1165,7 @@@ ZVAL_LONG(*rval, parse_iv(start + 2)); return 1; } - #line 1167 "ext/standard/var_unserializer.c" -#line 1174 "ext/standard/var_unserializer.c" ++#line 1169 "ext/standard/var_unserializer.c" yy83: yych = *++YYCURSOR; if (yych <= '/') goto yy18; @@@ -1171,24 -1178,24 +1173,24 @@@ yych = *++YYCURSOR; if (yych != ';') goto yy18; ++YYCURSOR; - #line 536 "ext/standard/var_unserializer.re" -#line 542 "ext/standard/var_unserializer.re" ++#line 537 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_BOOL(*rval, parse_iv(start + 2)); return 1; } - #line 1182 "ext/standard/var_unserializer.c" -#line 1189 "ext/standard/var_unserializer.c" ++#line 1184 "ext/standard/var_unserializer.c" yy87: ++YYCURSOR; - #line 529 "ext/standard/var_unserializer.re" -#line 535 "ext/standard/var_unserializer.re" ++#line 530 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_NULL(*rval); return 1; } - #line 1192 "ext/standard/var_unserializer.c" -#line 1199 "ext/standard/var_unserializer.c" ++#line 1194 "ext/standard/var_unserializer.c" yy89: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1211,7 -1218,7 +1213,7 @@@ yy91 if (yych <= '9') goto yy91; if (yych != ';') goto yy18; ++YYCURSOR; - #line 506 "ext/standard/var_unserializer.re" -#line 512 "ext/standard/var_unserializer.re" ++#line 507 "ext/standard/var_unserializer.re" { long id; @@@ -1234,7 -1241,7 +1236,7 @@@ return 1; } - #line 1238 "ext/standard/var_unserializer.c" -#line 1245 "ext/standard/var_unserializer.c" ++#line 1240 "ext/standard/var_unserializer.c" yy95: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1257,7 -1264,7 +1259,7 @@@ yy97 if (yych <= '9') goto yy97; if (yych != ';') goto yy18; ++YYCURSOR; - #line 485 "ext/standard/var_unserializer.re" -#line 491 "ext/standard/var_unserializer.re" ++#line 486 "ext/standard/var_unserializer.re" { long id; @@@ -1278,9 -1285,9 +1280,9 @@@ return 1; } - #line 1282 "ext/standard/var_unserializer.c" -#line 1289 "ext/standard/var_unserializer.c" ++#line 1284 "ext/standard/var_unserializer.c" } - #line 834 "ext/standard/var_unserializer.re" -#line 840 "ext/standard/var_unserializer.re" ++#line 835 "ext/standard/var_unserializer.re" return 0;
diff --cc ext/standard/var_unserializer.c index 26e532a,188d2da..ac17529 --- a/ext/standard/var_unserializer.c +++ b/ext/standard/var_unserializer.c @@@ -477,7 -483,7 +478,7 @@@ PHPAPI int php_var_unserialize(UNSERIAL - #line 481 "ext/standard/var_unserializer.c" -#line 487 "ext/standard/var_unserializer.c" ++#line 482 "ext/standard/var_unserializer.c" { YYCTYPE yych; static const unsigned char yybm[] = { @@@ -537,9 -543,9 +538,9 @@@ yy2 yych = *(YYMARKER = ++YYCURSOR); if (yych == ':') goto yy95; yy3: - #line 832 "ext/standard/var_unserializer.re" -#line 838 "ext/standard/var_unserializer.re" ++#line 833 "ext/standard/var_unserializer.re" { return 0; } - #line 543 "ext/standard/var_unserializer.c" -#line 549 "ext/standard/var_unserializer.c" ++#line 544 "ext/standard/var_unserializer.c" yy4: yych = *(YYMARKER = ++YYCURSOR); if (yych == ':') goto yy89; @@@ -582,13 -588,13 +583,13 @@@ yy13 goto yy3; yy14: ++YYCURSOR; - #line 826 "ext/standard/var_unserializer.re" -#line 832 "ext/standard/var_unserializer.re" ++#line 827 "ext/standard/var_unserializer.re" { /* this is the case where we have less data than planned */ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data"); return 0; /* not sure if it should be 0 or 1 here? */ } - #line 592 "ext/standard/var_unserializer.c" -#line 598 "ext/standard/var_unserializer.c" ++#line 593 "ext/standard/var_unserializer.c" yy16: yych = *++YYCURSOR; goto yy3; @@@ -618,7 -625,7 +620,7 @@@ yy20 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 680 "ext/standard/var_unserializer.re" -#line 686 "ext/standard/var_unserializer.re" ++#line 681 "ext/standard/var_unserializer.re" { size_t len, len2, len3, maxlen; long elements; @@@ -764,7 -771,7 +766,7 @@@ return object_common2(UNSERIALIZE_PASSTHRU, elements); } - #line 768 "ext/standard/var_unserializer.c" -#line 775 "ext/standard/var_unserializer.c" ++#line 770 "ext/standard/var_unserializer.c" yy25: yych = *++YYCURSOR; if (yych <= ',') { @@@ -789,7 -796,7 +791,7 @@@ yy27 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 672 "ext/standard/var_unserializer.re" -#line 678 "ext/standard/var_unserializer.re" ++#line 673 "ext/standard/var_unserializer.re" { INIT_PZVAL(*rval); @@@ -797,7 -804,7 +799,7 @@@ return object_common2(UNSERIALIZE_PASSTHRU, object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); } - #line 801 "ext/standard/var_unserializer.c" -#line 808 "ext/standard/var_unserializer.c" ++#line 803 "ext/standard/var_unserializer.c" yy32: yych = *++YYCURSOR; if (yych == '+') goto yy33; @@@ -818,7 -825,7 +820,7 @@@ yy34 yych = *++YYCURSOR; if (yych != '{') goto yy18; ++YYCURSOR; - #line 652 "ext/standard/var_unserializer.re" -#line 658 "ext/standard/var_unserializer.re" ++#line 653 "ext/standard/var_unserializer.re" { long elements = parse_iv(start + 2); /* use iv() not uiv() in order to check data range */ @@@ -838,7 -845,7 +840,7 @@@ return finish_nested_data(UNSERIALIZE_PASSTHRU); } - #line 842 "ext/standard/var_unserializer.c" -#line 849 "ext/standard/var_unserializer.c" ++#line 844 "ext/standard/var_unserializer.c" yy39: yych = *++YYCURSOR; if (yych == '+') goto yy40; @@@ -859,7 -866,7 +861,7 @@@ yy41 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 623 "ext/standard/var_unserializer.re" -#line 629 "ext/standard/var_unserializer.re" ++#line 624 "ext/standard/var_unserializer.re" { size_t len, maxlen; char *str; @@@ -888,7 -895,7 +890,7 @@@ ZVAL_STRINGL(*rval, str, len, 0); return 1; } - #line 892 "ext/standard/var_unserializer.c" -#line 899 "ext/standard/var_unserializer.c" ++#line 894 "ext/standard/var_unserializer.c" yy46: yych = *++YYCURSOR; if (yych == '+') goto yy47; @@@ -909,7 -916,7 +911,7 @@@ yy48 yych = *++YYCURSOR; if (yych != '"') goto yy18; ++YYCURSOR; - #line 595 "ext/standard/var_unserializer.re" -#line 601 "ext/standard/var_unserializer.re" ++#line 596 "ext/standard/var_unserializer.re" { size_t len, maxlen; char *str; @@@ -937,7 -944,7 +939,7 @@@ ZVAL_STRINGL(*rval, str, len, 1); return 1; } - #line 941 "ext/standard/var_unserializer.c" -#line 948 "ext/standard/var_unserializer.c" ++#line 943 "ext/standard/var_unserializer.c" yy53: yych = *++YYCURSOR; if (yych <= '/') { @@@ -1025,7 -1032,7 +1027,7 @@@ yy61 } yy63: ++YYCURSOR; - #line 585 "ext/standard/var_unserializer.re" -#line 591 "ext/standard/var_unserializer.re" ++#line 586 "ext/standard/var_unserializer.re" { #if SIZEOF_LONG == 4 use_double: @@@ -1035,7 -1042,7 +1037,7 @@@ ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL)); return 1; } - #line 1039 "ext/standard/var_unserializer.c" -#line 1046 "ext/standard/var_unserializer.c" ++#line 1041 "ext/standard/var_unserializer.c" yy65: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1094,7 -1101,7 +1096,7 @@@ yy73 yych = *++YYCURSOR; if (yych != ';') goto yy18; ++YYCURSOR; - #line 570 "ext/standard/var_unserializer.re" -#line 576 "ext/standard/var_unserializer.re" ++#line 571 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); @@@ -1109,7 -1116,7 +1111,7 @@@ return 1; } - #line 1113 "ext/standard/var_unserializer.c" -#line 1120 "ext/standard/var_unserializer.c" ++#line 1115 "ext/standard/var_unserializer.c" yy76: yych = *++YYCURSOR; if (yych == 'N') goto yy73; @@@ -1136,7 -1143,7 +1138,7 @@@ yy79 if (yych <= '9') goto yy79; if (yych != ';') goto yy18; ++YYCURSOR; - #line 543 "ext/standard/var_unserializer.re" -#line 549 "ext/standard/var_unserializer.re" ++#line 544 "ext/standard/var_unserializer.re" { #if SIZEOF_LONG == 4 int digits = YYCURSOR - start - 3; @@@ -1163,7 -1170,7 +1165,7 @@@ ZVAL_LONG(*rval, parse_iv(start + 2)); return 1; } - #line 1167 "ext/standard/var_unserializer.c" -#line 1174 "ext/standard/var_unserializer.c" ++#line 1169 "ext/standard/var_unserializer.c" yy83: yych = *++YYCURSOR; if (yych <= '/') goto yy18; @@@ -1171,24 -1178,24 +1173,24 @@@ yych = *++YYCURSOR; if (yych != ';') goto yy18; ++YYCURSOR; - #line 536 "ext/standard/var_unserializer.re" -#line 542 "ext/standard/var_unserializer.re" ++#line 537 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_BOOL(*rval, parse_iv(start + 2)); return 1; } - #line 1182 "ext/standard/var_unserializer.c" -#line 1189 "ext/standard/var_unserializer.c" ++#line 1184 "ext/standard/var_unserializer.c" yy87: ++YYCURSOR; - #line 529 "ext/standard/var_unserializer.re" -#line 535 "ext/standard/var_unserializer.re" ++#line 530 "ext/standard/var_unserializer.re" { *p = YYCURSOR; INIT_PZVAL(*rval); ZVAL_NULL(*rval); return 1; } - #line 1192 "ext/standard/var_unserializer.c" -#line 1199 "ext/standard/var_unserializer.c" ++#line 1194 "ext/standard/var_unserializer.c" yy89: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1211,7 -1218,7 +1213,7 @@@ yy91 if (yych <= '9') goto yy91; if (yych != ';') goto yy18; ++YYCURSOR; - #line 506 "ext/standard/var_unserializer.re" -#line 512 "ext/standard/var_unserializer.re" ++#line 507 "ext/standard/var_unserializer.re" { long id; @@@ -1234,7 -1241,7 +1236,7 @@@ return 1; } - #line 1238 "ext/standard/var_unserializer.c" -#line 1245 "ext/standard/var_unserializer.c" ++#line 1240 "ext/standard/var_unserializer.c" yy95: yych = *++YYCURSOR; if (yych <= ',') { @@@ -1257,7 -1264,7 +1259,7 @@@ yy97 if (yych <= '9') goto yy97; if (yych != ';') goto yy18; ++YYCURSOR; - #line 485 "ext/standard/var_unserializer.re" -#line 491 "ext/standard/var_unserializer.re" ++#line 486 "ext/standard/var_unserializer.re" { long id; @@@ -1278,9 -1285,9 +1280,9 @@@ return 1; } - #line 1282 "ext/standard/var_unserializer.c" -#line 1289 "ext/standard/var_unserializer.c" ++#line 1284 "ext/standard/var_unserializer.c" } - #line 834 "ext/standard/var_unserializer.re" -#line 840 "ext/standard/var_unserializer.re" ++#line 835 "ext/standard/var_unserializer.re" return 0;