summaryrefslogtreecommitdiffstats
path: root/bug73052.patch
diff options
context:
space:
mode:
authorRemi Collet <fedora@famillecollet.com>2016-09-19 14:11:20 +0200
committerRemi Collet <fedora@famillecollet.com>2016-09-19 14:11:20 +0200
commitb52e0db9c0cf11f6eda1e00f2d5292a0ac78424c (patch)
tree96d70499bf0e9c5a1e9e9909bbe68b63a44921c9 /bug73052.patch
parent9d9c34d5dfc86ad5cd292c1d8886d5c39f50e560 (diff)
PHP 5.5.38 with backports from 5.6.26
Diffstat (limited to 'bug73052.patch')
-rw-r--r--bug73052.patch65
1 files changed, 65 insertions, 0 deletions
diff --git a/bug73052.patch b/bug73052.patch
new file mode 100644
index 0000000..a94e98b
--- /dev/null
+++ b/bug73052.patch
@@ -0,0 +1,65 @@
+Backported from 5.6.26 by Remi.
+
+
+From ba8f3ba05f8545a243881547dcd5a1dcfe4d4fb2 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas@php.net>
+Date: Sun, 11 Sep 2016 21:19:29 -0700
+Subject: [PATCH] Fix bug #73052 - Memory Corruption in During
+ Deserialized-object Destruction
+
+---
+ Zend/zend_objects_API.c | 6 +--
+ ext/standard/tests/serialize/bug73052.phpt | 18 +++++++++
+ ext/standard/var_unserializer.c | 61 +++++++++++++++---------------
+ ext/standard/var_unserializer.re | 1 +
+ 4 files changed, 53 insertions(+), 33 deletions(-)
+ create mode 100644 ext/standard/tests/serialize/bug73052.phpt
+
+diff --git a/ext/standard/tests/serialize/bug73052.phpt b/ext/standard/tests/serialize/bug73052.phpt
+new file mode 100644
+index 0000000..63b484b
+--- /dev/null
++++ b/ext/standard/tests/serialize/bug73052.phpt
+@@ -0,0 +1,18 @@
++--TEST--
++Bug #73052: Memory Corruption in During Deserialized-object Destruction
++--FILE--
++<?php
++
++class obj {
++ var $ryat;
++ public function __destruct() {
++ $this->ryat = null;
++ }
++}
++
++$poc = 'O:3:"obj":1:{';
++var_dump(unserialize($poc));
++?>
++--EXPECTF--
++Notice: unserialize(): Error at offset 13 of 13 bytes in %sbug73052.php on line %d
++bool(false)
+diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
+index c8e6f8a..5491492 100644
+--- a/ext/standard/var_unserializer.c
++++ b/ext/standard/var_unserializer.c
+@@ -440,6 +440,7 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
+ /* We've got partially constructed object on our hands here. Wipe it. */
+ if(Z_TYPE_PP(rval) == IS_OBJECT) {
+ zend_hash_clean(Z_OBJPROP_PP(rval));
++ zend_object_store_ctor_failed(*rval TSRMLS_CC);
+ }
+ ZVAL_NULL(*rval);
+ return 0;
+diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
+index 11b93c5..ce84bf5 100644
+--- a/ext/standard/var_unserializer.re
++++ b/ext/standard/var_unserializer.re
+@@ -446,6 +446,7 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
+ /* We've got partially constructed object on our hands here. Wipe it. */
+ if(Z_TYPE_PP(rval) == IS_OBJECT) {
+ zend_hash_clean(Z_OBJPROP_PP(rval));
++ zend_object_store_ctor_failed(*rval TSRMLS_CC);
+ }
+ ZVAL_NULL(*rval);
+ return 0;