com php-src: Fix bug #73144 and bug #73341 - remove extra dtor: ext/spl/spl_array.c ext/standard/tests/serialize/bug7 3341.phpt

Commit: b433034febb099835a61943986522eb246115910 Author: Stanislav Malyshev <stas@php.net> Sun, 23 Oct 2016 21:56:35 -0700 Committer: Ferenc Kovacs <tyra3l@gmail.com> Wed, 9 Nov 2016 01:46:11 +0100 Parents: 0cd5cdeb04946f4fa2f6613220deb6c82ea71ff7 Branches: PHP-5.6.28 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=b433034febb099835a61943986522eb246115910 Log: Fix bug #73144 and bug #73341 - remove extra dtor Bugs: https://bugs.php.net/73144 https://bugs.php.net/73341 Changed paths: M ext/spl/spl_array.c A ext/standard/tests/serialize/bug73341.phpt Diff: diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 700d609..e7cbd1f 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1812,7 +1812,7 @@ SPL_METHOD(Array, unserialize) ALLOC_INIT_ZVAL(intern->array); if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC) || (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) { - zval_ptr_dtor(&intern->array); + // zval_ptr_dtor(&intern->array); goto outexcept; } var_push_dtor(&var_hash, &intern->array); diff --git a/ext/standard/tests/serialize/bug73341.phpt b/ext/standard/tests/serialize/bug73341.phpt new file mode 100644 index 0000000..5542321 --- /dev/null +++ b/ext/standard/tests/serialize/bug73341.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #73144 (Use-afte-free in ArrayObject Deserialization) +--FILE-- +<?php +try { +$token = 'a:2:{i:0;O:1:"0":2:0s:1:"0";i:0;s:1:"0";a:1:{i:0;C:11:"ArrayObject":7:0x:i:0;r0'; +$obj = unserialize($token); +} catch(Exception $e) { + echo $e->getMessage()."\n"; +} + +try { +$inner = 'x:i:1;O:8:"stdClass":1:{};m:a:0:{}'; +$exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}'; +unserialize($exploit); +} catch(Exception $e) { + echo $e->getMessage()."\n"; +} +?> +--EXPECTF-- +Error at offset 6 of 7 bytes + +Notice: ArrayObject::unserialize(): Unexpected end of serialized data in %sbug73341.php on line %d +Error at offset 24 of 34 bytes \ No newline at end of file