diff options
| author | Stanislav Malyshev <stas@php.net> | 2016-10-23 21:56:35 -0700 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2016-11-01 13:01:58 +0100 |
| commit | 7cf7920055d44da72529b4277e6890c99cf1932e (patch) | |
| tree | dff36030c03a7972bb67b8e88455f442b61ee446 | |
| parent | 6b21c28b0e82d760f0c3c4da89dae8d2fb685e1b (diff) | |
| download | php-git-7cf7920055d44da72529b4277e6890c99cf1932e.tar.gz | |
Fix bug #73144 and bug #73341 - remove extra dtor
(cherry picked from commit f74d7d92c8bc1edc2505e0b58546217e9e1ecb40)
Conflicts:
ext/spl/spl_array.c
Merged the test only, in 7.0 tree the removed dtor call is already
not present.
| -rw-r--r-- | ext/standard/tests/serialize/bug73341.phpt | 24 |
1 files changed, 24 insertions, 0 deletions
diff --git a/ext/standard/tests/serialize/bug73341.phpt b/ext/standard/tests/serialize/bug73341.phpt new file mode 100644 index 0000000000..55423217c3 --- /dev/null +++ b/ext/standard/tests/serialize/bug73341.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #73144 (Use-afte-free in ArrayObject Deserialization) +--FILE-- +<?php +try { +$token = 'a:2:{i:0;O:1:"0":2:0s:1:"0";i:0;s:1:"0";a:1:{i:0;C:11:"ArrayObject":7:0x:i:0;r0'; +$obj = unserialize($token); +} catch(Exception $e) { + echo $e->getMessage()."\n"; +} + +try { +$inner = 'x:i:1;O:8:"stdClass":1:{};m:a:0:{}'; +$exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}'; +unserialize($exploit); +} catch(Exception $e) { + echo $e->getMessage()."\n"; +} +?> +--EXPECTF-- +Error at offset 6 of 7 bytes + +Notice: ArrayObject::unserialize(): Unexpected end of serialized data in %sbug73341.php on line %d +Error at offset 24 of 34 bytes
\ No newline at end of file |