Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings
forked fromphp/php-src

Commit681a1af

Browse files
committed
Merge branch 'PHP-5.5' into PHP-5.6
* PHP-5.5: update news add CVE add missing test file Fix bug #68594 - Use after free vulnerability in unserialize()Conflicts:ext/standard/var_unserializer.c
2 parents181f34f +8efd73c commit681a1af

File tree

3 files changed

+62
-32
lines changed

3 files changed

+62
-32
lines changed
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
Bug #68545 Use after free vulnerability in unserialize()
3+
--FILE--
4+
<?php
5+
for ($i=4;$i<100;$i++) {
6+
$m =newStdClass();
7+
8+
$u =array(1);
9+
10+
$m->aaa =array(1,2,&$u,4,5);
11+
$m->bbb =1;
12+
$m->ccc = &$u;
13+
$m->ddd =str_repeat("A",$i);
14+
15+
$z =serialize($m);
16+
$z =str_replace("bbb","aaa",$z);
17+
$y =unserialize($z);
18+
$z =serialize($y);
19+
}
20+
?>
21+
===DONE===
22+
--EXPECTF--
23+
===DONE===

‎ext/standard/var_unserializer.c‎

Lines changed: 36 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Generated by re2c 0.13.5 */
1+
/* Generated by re2c 0.13.7.5 */
22
#line 1 "ext/standard/var_unserializer.re"
33
/*
44
+----------------------------------------------------------------------+
@@ -342,6 +342,9 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
342342
}else {
343343
/* object properties should include no integers */
344344
convert_to_string(key);
345+
if (zend_symtable_find(ht,Z_STRVAL_P(key),Z_STRLEN_P(key)+1, (void**)&old_data)==SUCCESS) {
346+
var_push_dtor(var_hash,old_data);
347+
}
345348
zend_hash_update(ht,Z_STRVAL_P(key),Z_STRLEN_P(key)+1,&data,
346349
sizeofdata,NULL);
347350
}
@@ -475,7 +478,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
475478

476479

477480

478-
#line479 "ext/standard/var_unserializer.c"
481+
#line482 "ext/standard/var_unserializer.c"
479482
{
480483
YYCTYPEyych;
481484
staticconstunsignedcharyybm[]= {
@@ -535,9 +538,9 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
535538
yych=*(YYMARKER=++YYCURSOR);
536539
if (yych==':') gotoyy95;
537540
yy3:
538-
#line830 "ext/standard/var_unserializer.re"
541+
#line833 "ext/standard/var_unserializer.re"
539542
{return0; }
540-
#line541 "ext/standard/var_unserializer.c"
543+
#line544 "ext/standard/var_unserializer.c"
541544
yy4:
542545
yych=*(YYMARKER=++YYCURSOR);
543546
if (yych==':') gotoyy89;
@@ -580,13 +583,13 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
580583
gotoyy3;
581584
yy14:
582585
++YYCURSOR;
583-
#line824 "ext/standard/var_unserializer.re"
586+
#line827 "ext/standard/var_unserializer.re"
584587
{
585588
/* this is the case where we have less data than planned */
586589
php_error_docref(NULLTSRMLS_CC,E_NOTICE,"Unexpected end of serialized data");
587590
return0;/* not sure if it should be 0 or 1 here? */
588591
}
589-
#line590 "ext/standard/var_unserializer.c"
592+
#line593 "ext/standard/var_unserializer.c"
590593
yy16:
591594
yych=*++YYCURSOR;
592595
gotoyy3;
@@ -612,11 +615,12 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
612615
if (yybm[0+yych]&128) {
613616
gotoyy20;
614617
}
615-
if (yych!=':') gotoyy18;
618+
if (yych <='/') gotoyy18;
619+
if (yych >=';') gotoyy18;
616620
yych=*++YYCURSOR;
617621
if (yych!='"') gotoyy18;
618622
++YYCURSOR;
619-
#line678 "ext/standard/var_unserializer.re"
623+
#line681 "ext/standard/var_unserializer.re"
620624
{
621625
size_tlen,len2,len3,maxlen;
622626
longelements;
@@ -762,7 +766,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
762766

763767
returnobject_common2(UNSERIALIZE_PASSTHRU,elements);
764768
}
765-
#line766 "ext/standard/var_unserializer.c"
769+
#line770 "ext/standard/var_unserializer.c"
766770
yy25:
767771
yych=*++YYCURSOR;
768772
if (yych <=',') {
@@ -787,15 +791,15 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
787791
yych=*++YYCURSOR;
788792
if (yych!='"') gotoyy18;
789793
++YYCURSOR;
790-
#line670 "ext/standard/var_unserializer.re"
794+
#line673 "ext/standard/var_unserializer.re"
791795
{
792796

793797
INIT_PZVAL(*rval);
794798

795799
returnobject_common2(UNSERIALIZE_PASSTHRU,
796800
object_common1(UNSERIALIZE_PASSTHRU,ZEND_STANDARD_CLASS_DEF_PTR));
797801
}
798-
#line799 "ext/standard/var_unserializer.c"
802+
#line803 "ext/standard/var_unserializer.c"
799803
yy32:
800804
yych=*++YYCURSOR;
801805
if (yych=='+') gotoyy33;
@@ -816,7 +820,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
816820
yych=*++YYCURSOR;
817821
if (yych!='{') gotoyy18;
818822
++YYCURSOR;
819-
#line650 "ext/standard/var_unserializer.re"
823+
#line653 "ext/standard/var_unserializer.re"
820824
{
821825
longelements=parse_iv(start+2);
822826
/* use iv() not uiv() in order to check data range */
@@ -836,7 +840,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
836840

837841
returnfinish_nested_data(UNSERIALIZE_PASSTHRU);
838842
}
839-
#line840 "ext/standard/var_unserializer.c"
843+
#line844 "ext/standard/var_unserializer.c"
840844
yy39:
841845
yych=*++YYCURSOR;
842846
if (yych=='+') gotoyy40;
@@ -857,7 +861,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
857861
yych=*++YYCURSOR;
858862
if (yych!='"') gotoyy18;
859863
++YYCURSOR;
860-
#line621 "ext/standard/var_unserializer.re"
864+
#line624 "ext/standard/var_unserializer.re"
861865
{
862866
size_tlen,maxlen;
863867
char*str;
@@ -886,7 +890,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
886890
ZVAL_STRINGL(*rval,str,len,0);
887891
return1;
888892
}
889-
#line890 "ext/standard/var_unserializer.c"
893+
#line894 "ext/standard/var_unserializer.c"
890894
yy46:
891895
yych=*++YYCURSOR;
892896
if (yych=='+') gotoyy47;
@@ -907,7 +911,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
907911
yych=*++YYCURSOR;
908912
if (yych!='"') gotoyy18;
909913
++YYCURSOR;
910-
#line593 "ext/standard/var_unserializer.re"
914+
#line596 "ext/standard/var_unserializer.re"
911915
{
912916
size_tlen,maxlen;
913917
char*str;
@@ -935,7 +939,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
935939
ZVAL_STRINGL(*rval,str,len,1);
936940
return1;
937941
}
938-
#line939 "ext/standard/var_unserializer.c"
942+
#line943 "ext/standard/var_unserializer.c"
939943
yy53:
940944
yych=*++YYCURSOR;
941945
if (yych <='/') {
@@ -1023,7 +1027,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
10231027
}
10241028
yy63:
10251029
++YYCURSOR;
1026-
#line583 "ext/standard/var_unserializer.re"
1030+
#line586 "ext/standard/var_unserializer.re"
10271031
{
10281032
#ifSIZEOF_LONG==4
10291033
use_double:
@@ -1033,7 +1037,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
10331037
ZVAL_DOUBLE(*rval,zend_strtod((constchar*)start+2,NULL));
10341038
return1;
10351039
}
1036-
#line1037 "ext/standard/var_unserializer.c"
1040+
#line1041 "ext/standard/var_unserializer.c"
10371041
yy65:
10381042
yych=*++YYCURSOR;
10391043
if (yych <=',') {
@@ -1092,7 +1096,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
10921096
yych=*++YYCURSOR;
10931097
if (yych!=';') gotoyy18;
10941098
++YYCURSOR;
1095-
#line568 "ext/standard/var_unserializer.re"
1099+
#line571 "ext/standard/var_unserializer.re"
10961100
{
10971101
*p=YYCURSOR;
10981102
INIT_PZVAL(*rval);
@@ -1107,7 +1111,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
11071111

11081112
return1;
11091113
}
1110-
#line1111 "ext/standard/var_unserializer.c"
1114+
#line1115 "ext/standard/var_unserializer.c"
11111115
yy76:
11121116
yych=*++YYCURSOR;
11131117
if (yych=='N') gotoyy73;
@@ -1134,7 +1138,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
11341138
if (yych <='9') gotoyy79;
11351139
if (yych!=';') gotoyy18;
11361140
++YYCURSOR;
1137-
#line541 "ext/standard/var_unserializer.re"
1141+
#line544 "ext/standard/var_unserializer.re"
11381142
{
11391143
#ifSIZEOF_LONG==4
11401144
intdigits=YYCURSOR-start-3;
@@ -1161,32 +1165,32 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
11611165
ZVAL_LONG(*rval,parse_iv(start+2));
11621166
return1;
11631167
}
1164-
#line1165 "ext/standard/var_unserializer.c"
1168+
#line1169 "ext/standard/var_unserializer.c"
11651169
yy83:
11661170
yych=*++YYCURSOR;
11671171
if (yych <='/') gotoyy18;
11681172
if (yych >='2') gotoyy18;
11691173
yych=*++YYCURSOR;
11701174
if (yych!=';') gotoyy18;
11711175
++YYCURSOR;
1172-
#line534 "ext/standard/var_unserializer.re"
1176+
#line537 "ext/standard/var_unserializer.re"
11731177
{
11741178
*p=YYCURSOR;
11751179
INIT_PZVAL(*rval);
11761180
ZVAL_BOOL(*rval,parse_iv(start+2));
11771181
return1;
11781182
}
1179-
#line1180 "ext/standard/var_unserializer.c"
1183+
#line1184 "ext/standard/var_unserializer.c"
11801184
yy87:
11811185
++YYCURSOR;
1182-
#line527 "ext/standard/var_unserializer.re"
1186+
#line530 "ext/standard/var_unserializer.re"
11831187
{
11841188
*p=YYCURSOR;
11851189
INIT_PZVAL(*rval);
11861190
ZVAL_NULL(*rval);
11871191
return1;
11881192
}
1189-
#line1190 "ext/standard/var_unserializer.c"
1193+
#line1194 "ext/standard/var_unserializer.c"
11901194
yy89:
11911195
yych=*++YYCURSOR;
11921196
if (yych <=',') {
@@ -1209,7 +1213,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
12091213
if (yych <='9') gotoyy91;
12101214
if (yych!=';') gotoyy18;
12111215
++YYCURSOR;
1212-
#line504 "ext/standard/var_unserializer.re"
1216+
#line507 "ext/standard/var_unserializer.re"
12131217
{
12141218
longid;
12151219

@@ -1232,7 +1236,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
12321236

12331237
return1;
12341238
}
1235-
#line1236 "ext/standard/var_unserializer.c"
1239+
#line1240 "ext/standard/var_unserializer.c"
12361240
yy95:
12371241
yych=*++YYCURSOR;
12381242
if (yych <=',') {
@@ -1255,7 +1259,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
12551259
if (yych <='9') gotoyy97;
12561260
if (yych!=';') gotoyy18;
12571261
++YYCURSOR;
1258-
#line483 "ext/standard/var_unserializer.re"
1262+
#line486 "ext/standard/var_unserializer.re"
12591263
{
12601264
longid;
12611265

@@ -1276,9 +1280,9 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
12761280

12771281
return1;
12781282
}
1279-
#line1280 "ext/standard/var_unserializer.c"
1283+
#line1284 "ext/standard/var_unserializer.c"
12801284
}
1281-
#line832 "ext/standard/var_unserializer.re"
1285+
#line835 "ext/standard/var_unserializer.re"
12821286

12831287

12841288
return0;

‎ext/standard/var_unserializer.re‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,9 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
346346
}else {
347347
/* object properties should include no integers*/
348348
convert_to_string(key);
349+
if (zend_symtable_find(ht,Z_STRVAL_P(key),Z_STRLEN_P(key) +1, (void **)&old_data)==SUCCESS) {
350+
var_push_dtor(var_hash, old_data);
351+
}
349352
zend_hash_update(ht,Z_STRVAL_P(key),Z_STRLEN_P(key) +1, &data,
350353
sizeof data,NULL);
351354
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp