com php-src: Fixed bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()): NEWS ext/spl/spl_iterators.c
ext/spl/tests/bug6997 0.phpt

Commit: e41f600365fe9f27727a62a850a4d55416ae856f Author: Xinchen Hui <laruence@php.net> Tue, 7 Jul 2015 21:25:28 +0800 Parents: c22da81b71abe8c41a94fdea4e95a2bca8ec926d Branches: PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=e41f600365fe9f27727a62a850a4d55416ae856f Log: Fixed bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()) Bugs: https://bugs.php.net/69970 Changed paths: M NEWS M ext/spl/spl_iterators.c A ext/spl/tests/bug69970.phpt Diff: diff --git a/NEWS b/NEWS index f965742..963a3f1 100644 --- a/NEWS +++ b/NEWS @@ -14,6 +14,10 @@ PHP NEWS . Fixed bug #69882 (OpenSSL error “key values mismatch” after openssl_pkcs12_read with extra cert) (Tomasz Sawicki) +- SPL: + . Fixed bug #69970 (Use-after-free vulnerability in + spl_recursive_it_move_forward_ex()). (Laruence) + 09 Jul 2015, PHP 5.6.11 - Core: diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c index 8588c7a..359d94d 100644 --- a/ext/spl/spl_iterators.c +++ b/ext/spl/spl_iterators.c @@ -380,9 +380,11 @@ next_step: } } } - iterator->funcs->dtor(iterator TSRMLS_CC); - zval_ptr_dtor(&object->iterators[object->level].zobject); - object->level--; + if (object->level > 0) { + iterator->funcs->dtor(iterator TSRMLS_CC); + zval_ptr_dtor(&object->iterators[object->level].zobject); + object->level--; + } } else { return; /* done completeley */ } diff --git a/ext/spl/tests/bug69970.phpt b/ext/spl/tests/bug69970.phpt new file mode 100644 index 0000000..a488037 --- /dev/null +++ b/ext/spl/tests/bug69970.phpt @@ -0,0 +1,45 @@ +--TEST-- +Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()) +--FILE-- +<?php + +$count = 10; + +class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator { + function rewind() { + echo "dummy\n"; + } + function endChildren() { + global $count; + echo $this->getDepth(); + if (--$count > 0) { + // Trigger use-after-free + parent::rewind(); + } + } +} +$arr = array("a", array("ba", array("bba", "bbb"))); +$obj = new RecursiveArrayIterator($arr); +$rit = new RecursiveArrayIteratorIterator($obj); + +foreach ($rit as $k => $v) { + echo ($rit->getDepth()) . "$k=>$v\n"; +} +?> +--EXPECT-- +dummy +00=>a +00=>a +10=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21