diff options
| author | CHU Zhaowei <jhdxr@php.net> | 2018-12-19 16:53:48 +0100 |
|---|---|---|
| committer | Christoph M. Becker <cmbecker69@gmx.de> | 2018-12-21 17:45:52 +0100 |
| commit | b15189f4d8af396cc5731a7b7eaeb0791cf0bced (patch) | |
| tree | 1c99d588ad96e571249c3b890604614eb7bd729a | |
| parent | 95193c38728986d27ac7129bcf1d3f74cc2c2cd7 (diff) | |
| download | php-git-b15189f4d8af396cc5731a7b7eaeb0791cf0bced.tar.gz | |
Fix #77298: segfault occurs when add property to unserialized empty ArrayObject
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | ext/spl/spl_array.c | 4 | ||||
| -rw-r--r-- | ext/spl/tests/bug77298.phpt | 28 |
3 files changed, 35 insertions, 1 deletions
@@ -2,6 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 7.3.2 +- SPL: + . Fixed bug #77298 (segfault occurs when add property to unserialized empty + ArrayObject). (jhdxr) + 03 Jan 2019, PHP 7.3.1 - Core: diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 63345e6e33..9b11782147 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1842,7 +1842,9 @@ SPL_METHOD(Array, unserialize) if (Z_TYPE_P(array) == IS_ARRAY) { zval_ptr_dtor(&intern->array); - ZVAL_COPY(&intern->array, array); + ZVAL_COPY_VALUE(&intern->array, array); + ZVAL_NULL(array); + SEPARATE_ARRAY(&intern->array); } else { spl_array_set_array(object, intern, array, 0L, 1); } diff --git a/ext/spl/tests/bug77298.phpt b/ext/spl/tests/bug77298.phpt new file mode 100644 index 0000000000..46eab670ff --- /dev/null +++ b/ext/spl/tests/bug77298.phpt @@ -0,0 +1,28 @@ +--TEST--
+Bug #77298 (segfault occurs when add property to unserialized ArrayObject)
+--FILE--
+<?php
+$o = new ArrayObject();
+$o2 = unserialize(serialize($o));
+$o2[1]=123;
+var_dump($o2);
+
+$o3 = new ArrayObject();
+$o3->unserialize($o->serialize());
+$o3['xm']=456;
+var_dump($o3);
+--EXPECT--
+object(ArrayObject)#2 (1) {
+ ["storage":"ArrayObject":private]=>
+ array(1) {
+ [1]=>
+ int(123)
+ }
+}
+object(ArrayObject)#3 (1) {
+ ["storage":"ArrayObject":private]=>
+ array(1) {
+ ["xm"]=>
+ int(456)
+ }
+}
\ No newline at end of file |