Re: Re: Bug 67072 resolution for 5.4/5.5
| From: | Stas Malyshev | Date: | Mon, 23 Jun 2014 17:41:10 +0000 |
| Subject: | Re: Re: Bug 67072 resolution for 5.4/5.5 | ||
| References: | 1 2 3 4 5 6 7 8 9 10 11 12 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-75052@lists.php.net to get a copy of this message | ||
Hi!
> Minimal reproducer:
>
> <?php
> class FooFile extends SplFileInfo {
> }
> $str = 'O:7:"FooFile":0:{}';
> var_dump(unserialize($str));
> ?>
I'm afraid here we can't do much - SplFileInfo is one of the classes
that it is unsafe to instantiate this way. It's what original 67072 was
about and I don't think it's safe to leave it this way, since at best it
can crash any code that uses unserialize() on external data, at worst
you got RCE.
--
Stanislav Malyshev, Software Architect
SugarCRM: http://www.sugarcrm.com/
(408)454-6900 ext. 227