mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-23 01:44:06 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.3' into PHP-8.4

Browse Source
This commit is contained in:
David Carlier 2024-11-03 13:40:25 +00:00
commit f5b0a9ad19
No known key found for this signature in database
GPG Key ID: 8486F847B4B94EF1
2 changed files with 30 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
ext/sysvmsg/sysvmsg.c
View File

@ -370,11 +370,19 @@ PHP_FUNCTION(msg_send)
php_var_serialize(&msg_var, message, &var_hash);
PHP_VAR_SERIALIZE_DESTROY(var_hash);
if (UNEXPECTED(EG(exception))) {
smart_str_free(&msg_var);
RETURN_THROWS();
}
zend_string *str = smart_str_extract(&msg_var);
message_len = ZSTR_LEN(str);
/* NB: php_msgbuf is 1 char bigger than a long, so there is no need to
* allocate the extra byte. */
messagebuffer = safe_emalloc(ZSTR_LEN(msg_var.s), 1, sizeof(struct php_msgbuf));
memcpy(messagebuffer->mtext, ZSTR_VAL(msg_var.s), ZSTR_LEN(msg_var.s) + 1);
message_len = ZSTR_LEN(msg_var.s);
messagebuffer = safe_emalloc(message_len, 1, sizeof(struct php_msgbuf));
memcpy(messagebuffer->mtext, ZSTR_VAL(str), message_len + 1);
zend_string_release_ex(str, false);
smart_str_free(&msg_var);
} else {
char *p;

19
ext/sysvmsg/tests/gh16592.phpt Normal file
View File

@ -0,0 +1,19 @@
--TEST--
msg_send() segfault when the type does not serialize as expected
--EXTENSIONS--
sysvmsg
--FILE--
<?php
class Test {
function __serialize() {}
}
$q = msg_get_queue(1);
try {
msg_send($q, 1, new Test, true);
} catch (\TypeError $e) {
echo $e->getMessage();
}
?>
--EXPECT--
Test::__serialize() must return an array