mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #34045 (Buffer overflow with serialized object)

Browse Source
This commit is contained in:
Dmitry Stogov 2005-08-10 06:37:19 +00:00
parent 1a29376c07
commit f0f1557998
4 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
NEWS
View File

@ -10,6 +10,7 @@ PHP NEWS
- Fixed "make test" to work for phpized extensions. (Hartmut, Jani)
- Fixed failing queries (FALSE returned) with mysqli_query() on 64 bit systems.
(Andrey)
- Fixed bug #34045 (Buffer overflow with serialized object). (Dmitry)
- Fixed bug #33999 (object remains object when cast to int). (Dmitry)
- Fixed bug #33996 (No information given for fatal error on passing invalid
value to typed argument). (Dmitry)

28
Zend/tests/bug34045.phpt Executable file
View File

@ -0,0 +1,28 @@
--TEST--
Bug #34045 (Buffer overflow with serialized object)
--FILE--
<?php
class BasicSingleton
{
private static $instance;
public function __wakeup() {
self::$instance = $this;
}
public static function singleton() {
if (!(self::$instance instanceof BasicSingleton)) {
$c = __CLASS__;
self::$instance = new $c;
}
return self::$instance;
}
}
$db = BasicSingleton::singleton();
$db_str = serialize($db);
$db2 = unserialize($db_str);
echo "ok\n";
?>
--EXPECT--
ok

4
Zend/zend_vm_def.h
View File

@ -1838,10 +1838,14 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
}
EG(current_execute_data) = EXECUTE_DATA;
/* We shouldn't fix bad extensions here,
because it can break proper ones (Bug #34045)
if (!EX(function_state).function->common.return_reference) {
EX_T(opline->result.u.var).var.ptr->is_ref = 0;
EX_T(opline->result.u.var).var.ptr->refcount = 1;
}
*/
if (!return_value_used) {
zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr);
}

4
Zend/zend_vm_execute.h
View File

@ -187,10 +187,14 @@ static int zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
}
EG(current_execute_data) = execute_data;
/* We shouldn't fix bad extensions here,
because it can break proper ones (Bug #34045)
if (!EX(function_state).function->common.return_reference) {
EX_T(opline->result.u.var).var.ptr->is_ref = 0;
EX_T(opline->result.u.var).var.ptr->refcount = 1;
}
*/
if (!return_value_used) {
zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr);
}