com php-src: Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key: ext/spl/spl_observer.c

Commit: f901dce57548cf1ef63578966ee16fa11509adcf Author: Stanislav Malyshev <stas@php.net> Mon, 10 Oct 2016 22:54:29 -0700 Committer: Anatol Belski <ab@php.net> Fri, 14 Oct 2016 01:36:57 +0200 Parents: c4254588a9d3b7067f84dbb84db4afcf646b5b40 Branches: PHP-7.1 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=f901dce57548cf1ef63578966ee16fa11509adcf Log: Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key (cherry picked from commit 61cdd1255d5b9c8453be71aacbbf682796ac77d4) Bugs: https://bugs.php.net/73257 https://bugs.php.net/73258 Changed paths: M ext/spl/spl_observer.c Diff: diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c index 4ad0c6d..b94ab40 100644 --- a/ext/spl/spl_observer.c +++ b/ext/spl/spl_observer.c @@ -788,6 +788,9 @@ SPL_METHOD(SplObjectStorage, unserialize) --p; /* for ';' */ count = Z_LVAL_P(pcount); + ZVAL_UNDEF(&entry); + ZVAL_UNDEF(&inf); + while (count-- > 0) { spl_SplObjectStorageElement *pelement; zend_hash_key key; @@ -803,18 +806,17 @@ SPL_METHOD(SplObjectStorage, unserialize) if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) { goto outexcept; } - if (Z_TYPE(entry) != IS_OBJECT) { - zval_ptr_dtor(&entry); - goto outexcept; - } if (*p == ',') { /* new version has inf */ ++p; if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) { zval_ptr_dtor(&entry); goto outexcept; } - } else { - ZVAL_UNDEF(&inf); + } + if (Z_TYPE(entry) != IS_OBJECT) { + zval_ptr_dtor(&entry); + zval_ptr_dtor(&inf); + goto outexcept; } if (spl_object_storage_get_hash(&key, intern, getThis(), &entry) == FAILURE) {