mirror of
https://github.com/php/php-src.git
synced 2026-03-24 00:02:20 +01:00
0458b3c8db
Exposing INDIRECTs to userland is not allowed and can lead to all sorts of wrong behaviour. In this case it lead to UAF bugs. Solve it by duplicating the properties table, which de-indirects the elements and also decouples it for future modifications. Closes GH-20102.
50 lines
731 B
PHP
50 lines
731 B
PHP
--TEST--
|
|
GH-20101 (SplHeap/SplPriorityQueue serialization exposes INDIRECTs)
|
|
--FILE--
|
|
<?php
|
|
class CustomHeap extends SplMaxHeap {
|
|
public $field = 0;
|
|
}
|
|
$heap = new CustomHeap();
|
|
$data = $heap->__serialize();
|
|
var_dump($data);
|
|
|
|
class CustomPriorityQueue extends SplPriorityQueue {
|
|
public $field = 0;
|
|
}
|
|
$pqueue = new CustomPriorityQueue();
|
|
$data = $pqueue->__serialize();
|
|
var_dump($data);
|
|
?>
|
|
--EXPECT--
|
|
array(2) {
|
|
[0]=>
|
|
array(1) {
|
|
["field"]=>
|
|
int(0)
|
|
}
|
|
[1]=>
|
|
array(2) {
|
|
["flags"]=>
|
|
int(0)
|
|
["heap_elements"]=>
|
|
array(0) {
|
|
}
|
|
}
|
|
}
|
|
array(2) {
|
|
[0]=>
|
|
array(1) {
|
|
["field"]=>
|
|
int(0)
|
|
}
|
|
[1]=>
|
|
array(2) {
|
|
["flags"]=>
|
|
int(1)
|
|
["heap_elements"]=>
|
|
array(0) {
|
|
}
|
|
}
|
|
}
|