mirror of
https://github.com/php/php-src.git
synced 2026-04-22 23:48:14 +02:00
Tim Düsterhus
f2e8c5da90
* unserialize: Strictly check for `:{` at object start
* unserialize: Update CVE tests
It's unlikely that the object syntax error contributed to the actual CVE. The
CVE is rather caused by the incorrect object serialization data of the `C`
format. Add a second string without such a syntax error to ensure that path is
still executed as well to ensure the CVE is absent.
* Fix test expectation in gmp/tests/bug74670.phpt
No changes to the input required, because the test actually is intended to
verify the behavior for a missing `}`, it's just that the report position changed.
* NEWS
* UPGRADING
18 lines
469 B
PHP
18 lines
469 B
PHP
--TEST--
|
|
Object serialization / unserialization: Strict format
|
|
--FILE--
|
|
<?php
|
|
class A {public $a;}
|
|
|
|
var_dump(unserialize('O:1:"A":1x{s:1:"a";N;}'));
|
|
//0123456789012345678901
|
|
var_dump(unserialize('O:1:"A":1:xs:1:"a";N;}'));
|
|
//0123456789012345678901
|
|
?>
|
|
--EXPECTF--
|
|
Notice: unserialize(): Error at offset 9 of 22 bytes in %s on line %d
|
|
bool(false)
|
|
|
|
Notice: unserialize(): Error at offset 10 of 22 bytes in %s on line %d
|
|
bool(false)
|