Backported from 5.6.26 by Remi. From ba8f3ba05f8545a243881547dcd5a1dcfe4d4fb2 Mon Sep 17 00:00:00 2001 From: Stanislav Malyshev Date: Sun, 11 Sep 2016 21:19:29 -0700 Subject: [PATCH] Fix bug #73052 - Memory Corruption in During Deserialized-object Destruction --- Zend/zend_objects_API.c | 6 +-- ext/standard/tests/serialize/bug73052.phpt | 18 +++++++++ ext/standard/var_unserializer.c | 61 +++++++++++++++--------------- ext/standard/var_unserializer.re | 1 + 4 files changed, 53 insertions(+), 33 deletions(-) create mode 100644 ext/standard/tests/serialize/bug73052.phpt diff --git a/ext/standard/tests/serialize/bug73052.phpt b/ext/standard/tests/serialize/bug73052.phpt new file mode 100644 index 0000000..63b484b --- /dev/null +++ b/ext/standard/tests/serialize/bug73052.phpt @@ -0,0 +1,18 @@ +--TEST-- +Bug #73052: Memory Corruption in During Deserialized-object Destruction +--FILE-- +ryat = null; + } +} + +$poc = 'O:3:"obj":1:{'; +var_dump(unserialize($poc)); +?> +--EXPECTF-- +Notice: unserialize(): Error at offset 13 of 13 bytes in %sbug73052.php on line %d +bool(false) diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c index c8e6f8a..5491492 100644 --- a/ext/standard/var_unserializer.c +++ b/ext/standard/var_unserializer.c @@ -440,6 +440,7 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements) /* We've got partially constructed object on our hands here. Wipe it. */ if(Z_TYPE_PP(rval) == IS_OBJECT) { zend_hash_clean(Z_OBJPROP_PP(rval)); + zend_object_store_ctor_failed(*rval TSRMLS_CC); } ZVAL_NULL(*rval); return 0; diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re index 11b93c5..ce84bf5 100644 --- a/ext/standard/var_unserializer.re +++ b/ext/standard/var_unserializer.re @@ -446,6 +446,7 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements) /* We've got partially constructed object on our hands here. Wipe it. */ if(Z_TYPE_PP(rval) == IS_OBJECT) { zend_hash_clean(Z_OBJPROP_PP(rval)); + zend_object_store_ctor_failed(*rval TSRMLS_CC); } ZVAL_NULL(*rval); return 0;