mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())

Browse Source
This commit is contained in:
Xinchen Hui 2015-07-07 21:25:28 +08:00
parent c22da81b71
commit e41f600365
3 changed files with 54 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@ -14,6 +14,10 @@ PHP NEWS
. Fixed bug #69882 (OpenSSL error “key values mismatch” after
openssl_pkcs12_read with extra cert) (Tomasz Sawicki)
- SPL:
. Fixed bug #69970 (Use-after-free vulnerability in
spl_recursive_it_move_forward_ex()). (Laruence)
09 Jul 2015, PHP 5.6.11
- Core:

8
ext/spl/spl_iterators.c
View File

@ -380,9 +380,11 @@ next_step:
}
}
}
iterator->funcs->dtor(iterator TSRMLS_CC);
zval_ptr_dtor(&object->iterators[object->level].zobject);
object->level--;
if (object->level > 0) {
iterator->funcs->dtor(iterator TSRMLS_CC);
zval_ptr_dtor(&object->iterators[object->level].zobject);
object->level--;
}
} else {
return; /* done completeley */
}

45
ext/spl/tests/bug69970.phpt Normal file
View File

@ -0,0 +1,45 @@
--TEST--
Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())
--FILE--
<?php
$count = 10;
class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator {
function rewind() {
echo "dummy\n";
}
function endChildren() {
global $count;
echo $this->getDepth();
if (--$count > 0) {
// Trigger use-after-free
parent::rewind();
}
}
}
$arr = array("a", array("ba", array("bba", "bbb")));
$obj = new RecursiveArrayIterator($arr);
$rit = new RecursiveArrayIteratorIterator($obj);
foreach ($rit as $k => $v) {
echo ($rit->getDepth()) . "$k=>$v\n";
}
?>
--EXPECT--
dummy
00=>a
00=>a
10=>ba
20=>bba
21=>bbb
21010=>ba
20=>bba
21=>bbb
21010=>ba
20=>bba
21=>bbb
21010=>ba
20=>bba
21=>bbb
21