diff options
| author | Xinchen Hui <laruence@php.net> | 2014-07-02 17:57:42 +0800 |
|---|---|---|
| committer | Stanislav Malyshev <stas@php.net> | 2014-07-24 22:54:14 -0700 |
| commit | 51c38a09970c1f8395e68500c0b2ed1b3c9a6786 (patch) | |
| tree | bb145ed09cb0d74e7f05de438995e071c6977b18 /ext/spl | |
| parent | 61e0f8599d4e2a222ec49781e5be90fbbc1cd65b (diff) | |
| download | php-git-51c38a09970c1f8395e68500c0b2ed1b3c9a6786.tar.gz | |
Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting)
Diffstat (limited to 'ext/spl')
| -rw-r--r-- | ext/spl/spl_array.c | 7 | ||||
| -rw-r--r-- | ext/spl/tests/bug67539.phpt | 15 |
2 files changed, 22 insertions, 0 deletions
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index bf034ab248..ec9ce217d3 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1745,6 +1745,7 @@ SPL_METHOD(Array, unserialize) const unsigned char *p, *s; php_unserialize_data_t var_hash; zval *pmembers, *pflags = NULL; + HashTable *aht; long flags; if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) { @@ -1756,6 +1757,12 @@ SPL_METHOD(Array, unserialize) return; } + aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC); + if (aht->nApplyCount > 0) { + zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited"); + return; + } + /* storage */ s = p = (const unsigned char*)buf; PHP_VAR_UNSERIALIZE_INIT(var_hash); diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt new file mode 100644 index 0000000000..8bab2a8c21 --- /dev/null +++ b/ext/spl/tests/bug67539.phpt @@ -0,0 +1,15 @@ +--TEST-- +Bug #67539 (ArrayIterator use-after-free due to object change during sorting) +--FILE-- +<?php + +$it = new ArrayIterator(array_fill(0,2,'X'), 1 ); + +function badsort($a, $b) { + $GLOBALS['it']->unserialize($GLOBALS['it']->serialize()); + return TRUE; +} + +$it->uksort('badsort'); +--EXPECTF-- +Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d |