diff options
| author | Nikita Popov <nikic@php.net> | 2017-01-01 19:24:41 +0100 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2017-01-01 21:11:01 +0100 |
| commit | be4ce98bdc56f8342b28343b78e00477a344681f (patch) | |
| tree | cafd9ca1c8e15a520f28c8470645712dea3cd263 | |
| parent | 1d6f9345bc61890ba3d5ff2881214bc352f8f633 (diff) | |
| download | php-git-be4ce98bdc56f8342b28343b78e00477a344681f.tar.gz | |
Fixed bug #73154
The object that is being serialized may be destroyed during the
execution of __sleep(), so operate on a copy instead.
| -rw-r--r-- | ext/standard/tests/serialize/bug73154.phpt | 16 | ||||
| -rw-r--r-- | ext/standard/var.c | 16 |
2 files changed, 26 insertions, 6 deletions
diff --git a/ext/standard/tests/serialize/bug73154.phpt b/ext/standard/tests/serialize/bug73154.phpt new file mode 100644 index 0000000000..8d0f188bf7 --- /dev/null +++ b/ext/standard/tests/serialize/bug73154.phpt @@ -0,0 +1,16 @@ +--TEST-- +Bug #73154: serialize object with __sleep function crash +--FILE-- +<?php +class a { + public $a; + public function __sleep() { + $this->a=null; + return array(); + } +} +$s = 'a:1:{i:0;O:1:"a":1:{s:1:"a";R:2;}}'; +var_dump(serialize(unserialize($s))); +?> +--EXPECT-- +string(22) "a:1:{i:0;O:1:"a":0:{}}" diff --git a/ext/standard/var.c b/ext/standard/var.c index ef5e4272ef..7143634489 100644 --- a/ext/standard/var.c +++ b/ext/standard/var.c @@ -862,9 +862,6 @@ again: return; case IS_OBJECT: { - zval retval; - zval fname; - int res; zend_class_entry *ce = Z_OBJCE_P(struc); if (ce->serialize != NULL) { @@ -893,32 +890,39 @@ again: } if (ce != PHP_IC_ENTRY && zend_hash_str_exists(&ce->function_table, "__sleep", sizeof("__sleep")-1)) { + zval fname, tmp, retval; + int res; + + ZVAL_COPY(&tmp, struc); ZVAL_STRINGL(&fname, "__sleep", sizeof("__sleep") - 1); BG(serialize_lock)++; - res = call_user_function_ex(CG(function_table), struc, &fname, &retval, 0, 0, 1, NULL); + res = call_user_function_ex(CG(function_table), &tmp, &fname, &retval, 0, 0, 1, NULL); BG(serialize_lock)--; zval_dtor(&fname); if (EG(exception)) { zval_ptr_dtor(&retval); + zval_ptr_dtor(&tmp); return; } if (res == SUCCESS) { if (Z_TYPE(retval) != IS_UNDEF) { if (HASH_OF(&retval)) { - php_var_serialize_class(buf, struc, &retval, var_hash); + php_var_serialize_class(buf, &tmp, &retval, var_hash); } else { php_error_docref(NULL, E_NOTICE, "__sleep should return an array only containing the names of instance-variables to serialize"); /* we should still add element even if it's not OK, * since we already wrote the length of the array before */ smart_str_appendl(buf,"N;", 2); } - zval_ptr_dtor(&retval); } + zval_ptr_dtor(&retval); + zval_ptr_dtor(&tmp); return; } zval_ptr_dtor(&retval); + zval_ptr_dtor(&tmp); } /* fall-through */ |