mirror of
https://github.com/php/php-src.git
synced 2026-04-17 13:01:02 +02:00
c793885b76
Validate that "C" serialization payload is followed by "}" prior to calling the unserialize() handler. This mitigates issues caused by unserialize() not correctly handling strings that are not NUL terminated. Making sure that there is a "}" at the end avoids the problem.
17 lines
462 B
PHP
17 lines
462 B
PHP
--TEST--
|
|
Bug #71311 Use-after-free vulnerability in SPL(ArrayObject, unserialize)
|
|
--FILE--
|
|
<?php
|
|
$data = unserialize("C:11:\"ArrayObject\":11:{x:i:0;r:3;X}");
|
|
var_dump($data);
|
|
?>
|
|
--EXPECTF--
|
|
Fatal error: Uncaught UnexpectedValueException: Error at offset 10 of 11 bytes in %s%ebug71311.php:2
|
|
Stack trace:
|
|
#0 [internal function]: ArrayObject->unserialize('x:i:0;r:3;X')
|
|
#1 %s%ebug71311.php(2): unserialize('%s')
|
|
#2 {main}
|
|
thrown in %s%ebug71311.php on line 2
|
|
|
|
|