mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-01-22 11:44:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.2' into PHP-7.3

Browse Source
This commit is contained in:
Nikita Popov 2019-09-16 13:02:56 +02:00
commit 74876f09c4
2 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/spl/spl_observer.c
View File

@ -800,12 +800,14 @@ SPL_METHOD(SplObjectStorage, unserialize)
}
/* store reference to allow cross-references between different elements */
if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) {
zval_ptr_dtor(&entry);
goto outexcept;
}
if (*p == ',') { /* new version has inf */
++p;
if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) {
zval_ptr_dtor(&entry);
zval_ptr_dtor(&inf);
goto outexcept;
}
}

16
ext/standard/tests/serialize/unserialize_leak.phpt Normal file
View File

@ -0,0 +1,16 @@
--TEST--
Unserialize leak in SplObjectStorage
--FILE--
<?php
$payload = 'C:16:"SplObjectStorage":113:{x:i:2;O:8:"stdClass":1:{},a:2:{s:4:"prev";i:2;s:4:"next";O:8:"stdClass":0:{}};r:7;,R:2;s:4:"next";;r:3;};m:a:0:{}}';
try {
var_dump(unserialize($payload));
} catch (Exception $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECTF--
Notice: SplObjectStorage::unserialize(): Unexpected end of serialized data in %s on line %d
Error at offset 24 of 113 bytes