diff options
Diffstat (limited to 'bug73052.patch')
| -rw-r--r-- | bug73052.patch | 65 |
1 files changed, 65 insertions, 0 deletions
diff --git a/bug73052.patch b/bug73052.patch new file mode 100644 index 0000000..a94e98b --- /dev/null +++ b/bug73052.patch @@ -0,0 +1,65 @@ +Backported from 5.6.26 by Remi. + + +From ba8f3ba05f8545a243881547dcd5a1dcfe4d4fb2 Mon Sep 17 00:00:00 2001 +From: Stanislav Malyshev <stas@php.net> +Date: Sun, 11 Sep 2016 21:19:29 -0700 +Subject: [PATCH] Fix bug #73052 - Memory Corruption in During + Deserialized-object Destruction + +--- + Zend/zend_objects_API.c | 6 +-- + ext/standard/tests/serialize/bug73052.phpt | 18 +++++++++ + ext/standard/var_unserializer.c | 61 +++++++++++++++--------------- + ext/standard/var_unserializer.re | 1 + + 4 files changed, 53 insertions(+), 33 deletions(-) + create mode 100644 ext/standard/tests/serialize/bug73052.phpt + +diff --git a/ext/standard/tests/serialize/bug73052.phpt b/ext/standard/tests/serialize/bug73052.phpt +new file mode 100644 +index 0000000..63b484b +--- /dev/null ++++ b/ext/standard/tests/serialize/bug73052.phpt +@@ -0,0 +1,18 @@ ++--TEST-- ++Bug #73052: Memory Corruption in During Deserialized-object Destruction ++--FILE-- ++<?php ++ ++class obj { ++ var $ryat; ++ public function __destruct() { ++ $this->ryat = null; ++ } ++} ++ ++$poc = 'O:3:"obj":1:{'; ++var_dump(unserialize($poc)); ++?> ++--EXPECTF-- ++Notice: unserialize(): Error at offset 13 of 13 bytes in %sbug73052.php on line %d ++bool(false) +diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c +index c8e6f8a..5491492 100644 +--- a/ext/standard/var_unserializer.c ++++ b/ext/standard/var_unserializer.c +@@ -440,6 +440,7 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements) + /* We've got partially constructed object on our hands here. Wipe it. */ + if(Z_TYPE_PP(rval) == IS_OBJECT) { + zend_hash_clean(Z_OBJPROP_PP(rval)); ++ zend_object_store_ctor_failed(*rval TSRMLS_CC); + } + ZVAL_NULL(*rval); + return 0; +diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re +index 11b93c5..ce84bf5 100644 +--- a/ext/standard/var_unserializer.re ++++ b/ext/standard/var_unserializer.re +@@ -446,6 +446,7 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements) + /* We've got partially constructed object on our hands here. Wipe it. */ + if(Z_TYPE_PP(rval) == IS_OBJECT) { + zend_hash_clean(Z_OBJPROP_PP(rval)); ++ zend_object_store_ctor_failed(*rval TSRMLS_CC); + } + ZVAL_NULL(*rval); + return 0; |