mirror of
https://github.com/php/php-src.git
synced 2026-03-24 00:02:20 +01:00
cc39bc21e3
The `PS_ENCODE_LOOP` does not protect the session hash table that it iterates over. Change it by temporarily creating a copy. Closes GH-16640.
37 lines
634 B
PHP
37 lines
634 B
PHP
--TEST--
|
|
GH-16590 (UAF in session_encode())
|
|
--EXTENSIONS--
|
|
session
|
|
--SKIPIF--
|
|
<?php include('skipif.inc'); ?>
|
|
--INI--
|
|
session.use_cookies=0
|
|
session.cache_limiter=
|
|
session.serialize_handler=php
|
|
session.save_handler=files
|
|
--FILE--
|
|
<?php
|
|
|
|
class C {
|
|
function __serialize() {
|
|
$_SESSION = [];
|
|
return [];
|
|
}
|
|
}
|
|
|
|
session_start();
|
|
|
|
$_SESSION['Lz'] = new C;
|
|
for ($i = 0; $i < 2; $i++) {
|
|
$_SESSION[$i] = $i;
|
|
}
|
|
|
|
var_dump(session_encode());
|
|
|
|
?>
|
|
--EXPECTF--
|
|
Warning: session_encode(): Skipping numeric key 0 in %s on line %d
|
|
|
|
Warning: session_encode(): Skipping numeric key 1 in %s on line %d
|
|
string(15) "Lz|O:1:"C":0:{}"
|