diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-16 13:03:08 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-09-16 13:03:08 +0200 |
| commit | b29b8468634f5a9c23cea6f6ac405d154b5bd4de (patch) | |
| tree | 7779988f2ef28b96f12a43cfe081b2bbf7ea8c6b /ext | |
| parent | c8359fcea258e95fd55708fb2dbaf8b064c9ccab (diff) | |
| parent | 74876f09c4198200cef26f23dde6db58bcf1ddc3 (diff) | |
| download | php-git-b29b8468634f5a9c23cea6f6ac405d154b5bd4de.tar.gz | |
Merge branch 'PHP-7.3' into PHP-7.4
Diffstat (limited to 'ext')
| -rw-r--r-- | ext/spl/spl_observer.c | 2 | ||||
| -rw-r--r-- | ext/standard/tests/serialize/unserialize_leak.phpt | 16 |
2 files changed, 18 insertions, 0 deletions
diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c index b3879c5ec3..5b1e2cfe7e 100644 --- a/ext/spl/spl_observer.c +++ b/ext/spl/spl_observer.c @@ -800,12 +800,14 @@ SPL_METHOD(SplObjectStorage, unserialize) } /* store reference to allow cross-references between different elements */ if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) { + zval_ptr_dtor(&entry); goto outexcept; } if (*p == ',') { /* new version has inf */ ++p; if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) { zval_ptr_dtor(&entry); + zval_ptr_dtor(&inf); goto outexcept; } } diff --git a/ext/standard/tests/serialize/unserialize_leak.phpt b/ext/standard/tests/serialize/unserialize_leak.phpt new file mode 100644 index 0000000000..383bcfc075 --- /dev/null +++ b/ext/standard/tests/serialize/unserialize_leak.phpt @@ -0,0 +1,16 @@ +--TEST-- +Unserialize leak in SplObjectStorage +--FILE-- +<?php + +$payload = 'C:16:"SplObjectStorage":113:{x:i:2;O:8:"stdClass":1:{},a:2:{s:4:"prev";i:2;s:4:"next";O:8:"stdClass":0:{}};r:7;,R:2;s:4:"next";;r:3;};m:a:0:{}}'; +try { + var_dump(unserialize($payload)); +} catch (Exception $e) { + echo $e->getMessage(), "\n"; +} + +?> +--EXPECTF-- +Notice: SplObjectStorage::unserialize(): Unexpected end of serialized data in %s on line %d +Error at offset 24 of 113 bytes |