php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix GH-16588: UAF in Observer->serialize
This commit is contained in:
Niels Dossche
2024-10-25 23:00:52 +02:00
parent 922bd2fe52 3599fd0c51
commit 1740d94626
2 changed files with 30 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
ext/spl/spl_observer.c
View File

@@ -833,11 +833,18 @@ PHP_METHOD(SplObjectStorage, serialize)
RETURN_NULL();
}
ZVAL_OBJ(&obj, element->obj);
/* Protect against modification; we need a full copy because the data may be refcounted. */
zval inf_copy;
ZVAL_COPY(&inf_copy, &element->inf);
php_var_serialize(&buf, &obj, &var_hash);
smart_str_appendc(&buf, ',');
php_var_serialize(&buf, &element->inf, &var_hash);
php_var_serialize(&buf, &inf_copy, &var_hash);
smart_str_appendc(&buf, ';');
zend_hash_move_forward_ex(&intern->storage, &pos);
zval_ptr_dtor(&inf_copy);
}
/* members */

22
ext/spl/tests/gh16588.phpt Normal file
View File

@@ -0,0 +1,22 @@
--TEST--
GH-16588 (UAF in Observer->serialize)
--CREDITS--
chibinz
--FILE--
<?php
class C {
function __serialize(): array {
global $store;
$store->removeAll($store);
return [];
}
}
$store = new SplObjectStorage;
$store[new C] = new stdClass;
var_dump($store->serialize());
?>
--EXPECT--
string(47) "x:i:1;O:1:"C":0:{},O:8:"stdClass":0:{};m:a:0:{}"