com php-src: Fixed bug #68976 - Use After Free Vulnerability in unserialize(): ext/standard/var_unserializer.re
| From: | Stanislav Malyshev | Date: | Tue, 17 Mar 2015 23:31:52 +0000 |
| Subject: | com php-src: Fixed bug #68976 - Use After Free Vulnerability in unserialize(): ext/standard/var_unserializer.re | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-85584@lists.php.net to get a copy of this message | ||
Commit: 780222f97f47644a6a118ada86a269a96a1e8134
Author: Stanislav Malyshev <stas@php.net> Tue, 17 Mar 2015 13:20:22 -0700
Parents: 38e15d89d7b5efdabb599b2894219e3bd9739cfd
Branches: master
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=780222f97f47644a6a118ada86a269a96a1e8134
Log:
Fixed bug #68976 - Use After Free Vulnerability in unserialize()
Bugs:
https://bugs.php.net/68976
Changed paths:
M ext/standard/var_unserializer.re
Diff:
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 0b8a8cc..cfb116a 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -396,6 +396,8 @@ string_key:
return 0;
}
+ var_push_dtor(var_hash, data);
+
if (elements && *(*p-1) != ';' && *(*p-1) != '}') {
(*p)--;
return 0;