php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-27 01:32:22 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #73029 - Missing type check when unserializing SplArray

Browse Source 
(cherry picked from commit 6d16288150be33392a3249e417a0929881feb9a2)

Conflicts:
	ext/spl/spl_array.c
This commit is contained in:
Stanislav Malyshev
2016-09-11 20:24:13 -07:00
committed by Anatol Belski
parent 060ab26cfe
commit 022e75cba1
2 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ext/spl/spl_array.c
View File

@@ -295,7 +295,7 @@ static zval *spl_array_get_dimension_ptr(int check_inherited, spl_array_object *
zend_string *offset_key;
HashTable *ht = spl_array_get_hash_table(intern);
if (!offset || Z_ISUNDEF_P(offset)) {
if (!offset || Z_ISUNDEF_P(offset) || !ht) {
return &EG(uninitialized_zval);
}
@@ -1796,7 +1796,8 @@ SPL_METHOD(Array, unserialize)
intern->ar_flags |= flags & SPL_ARRAY_CLONE_MASK;
zval_ptr_dtor(&intern->array);
ZVAL_UNDEF(&intern->array);
if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash)) {
if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash)
|| (Z_TYPE(intern->array) != IS_ARRAY && Z_TYPE(intern->array) != IS_OBJECT)) {
goto outexcept;
}
var_push_dtor(&var_hash, &intern->array);

16
ext/spl/tests/bug73029.phpt Normal file
View File

@@ -0,0 +1,16 @@
--TEST--
Bug #73029: Missing type check when unserializing SplArray
--FILE--
<?php
try {
$a = 'C:11:"ArrayObject":19:0x:i:0;r:2;;m:a:0:{}}';
$m = unserialize($a);
$x = $m[2];
} catch(UnexpectedValueException $e) {
print $e->getMessage() . "\n";
}
?>
DONE
--EXPECTF--
Error at offset 10 of 19 bytes
DONE