php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-26 01:18:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix bug #72562 - destroy var_hash properly

Browse Source
This commit is contained in:
Stanislav Malyshev
2016-07-12 23:27:45 -07:00
parent aa82e99ed8
commit 3798eb6fd5
2 changed files with 46 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ext/session/session.c
+2 -1
View File
@@ -866,7 +866,7 @@ PS_SERIALIZER_DECODE_FUNC(php_serialize) /* {{{ */
if (php_var_unserialize(&session_vars, &val, endptr, &var_hash TSRMLS_CC)) {
var_push_dtor(&var_hash, &session_vars);
}
PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
if (PS(http_session_vars)) {
zval_ptr_dtor(&PS(http_session_vars));
@@ -931,6 +931,7 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) /* {{{ */
namelen = ((unsigned char)(*p)) & (~PS_BIN_UNDEF);
if (namelen < 0 || namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
return FAILURE;
}
ext/session/tests/bug72562.phpt
+44
View File
@@ -0,0 +1,44 @@
--TEST--
Bug #72562: Use After Free in unserialize() with Unexpected Session Deserialization
--SKIPIF--
<?php include('skipif.inc'); ?>
--FILE--
<?php
ini_set('session.serialize_handler', 'php_binary');
session_start();
$sess = "\x1xi:1;\x2y";
session_decode($sess);
$uns_1 = '{';
$out_1[] = unserialize($uns_1);
unset($out_1);
$fakezval = ptr2str(1122334455);
$fakezval .= ptr2str(0);
$fakezval .= "\x00\x00\x00\x00";
$fakezval .= "\x01";
$fakezval .= "\x00";
$fakezval .= "\x00\x00";
for ($i = 0; $i < 5; $i++) {
$v[$i] = $fakezval.$i;
}
$uns_2 = 'R:2;';
$out_2 = unserialize($uns_2);
var_dump($out_2);
function ptr2str($ptr)
{
$out = '';
for ($i = 0; $i < 8; $i++) {
$out .= chr($ptr & 0xff);
$ptr >>= 8;
}
return $out;
}
?>
--EXPECTF--
Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s/bug72562.php on line %d
Notice: unserialize(): Error at offset 0 of 1 bytes in %s/bug72562.php on line %d
Notice: unserialize(): Error at offset 4 of 4 bytes in %s/bug72562.php on line %d
bool(false)