php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix GH-20614: SplFixedArray incorrectly handles references in deserialization

Browse Source 
All other code caters to dereferencing array elements, except the
unserialize handler. This causes references to be present in the fixed
array even though this seems not intentional as reference assign is
otherwise impossible.
On 8.5+ this causes an assertion failure. On 8.3+ this causes references
to be present where they shouldn't be.

Closes GH-20616.
This commit is contained in:
Niels Dossche
2025-11-29 12:07:15 +01:00
parent 4312a446d0
commit 366ed4c750
3 changed files with 29 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
NEWS
View File

@@ -61,6 +61,10 @@ PHP NEWS
. Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog(). . Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().
(Girgias) (Girgias)
- SPL:
. Fixed bug GH-20614 (SplFixedArray incorrectly handles references
in deserialization). (ndossche)
- Standard: - Standard:
. Fix memory leak in array_diff() with custom type checks. (ndossche) . Fix memory leak in array_diff() with custom type checks. (ndossche)
. Fixed bug GH-20583 (Stack overflow in http_build_query . Fixed bug GH-20583 (Stack overflow in http_build_query

4
ext/spl/spl_fixedarray.c
View File

@@ -652,7 +652,7 @@ PHP_METHOD(SplFixedArray, __unserialize)
intern->array.size = 0; intern->array.size = 0;
ZEND_HASH_FOREACH_STR_KEY_VAL(data, key, elem) { ZEND_HASH_FOREACH_STR_KEY_VAL(data, key, elem) {
if (key == NULL) { if (key == NULL) {
ZVAL_COPY(&intern->array.elements[intern->array.size], elem); ZVAL_COPY_DEREF(&intern->array.elements[intern->array.size], elem);
intern->array.size++; intern->array.size++;
} else { } else {
Z_TRY_ADDREF_P(elem); Z_TRY_ADDREF_P(elem);
@@ -833,7 +833,7 @@ PHP_METHOD(SplFixedArray, offsetGet)
value = spl_fixedarray_object_read_dimension_helper(intern, zindex); value = spl_fixedarray_object_read_dimension_helper(intern, zindex);
if (value) { if (value) {
RETURN_COPY_DEREF(value); RETURN_COPY(value);
} else { } else {
RETURN_NULL(); RETURN_NULL();
} }

23
ext/spl/tests/gh20614.phpt Normal file
View File

@@ -0,0 +1,23 @@
--TEST--
GH-20614 (SplFixedArray incorrectly handles references in deserialization)
--FILE--
<?php
$fa = new SplFixedArray(0);
$nr = 1;
$array = [&$nr];
$fa->__unserialize($array);
var_dump($fa);
unset($fa[0]);
var_dump($fa);
?>
--EXPECT--
object(SplFixedArray)#1 (1) {
[0]=>
int(1)
}
object(SplFixedArray)#1 (1) {
[0]=>
NULL
}