1
0
mirror of https://github.com/php/php-src.git synced 2026-04-10 01:23:53 +02:00
Files
Tim Düsterhus f2e8c5da90 unserialize: Strictly check for :{ at object start (#10214)
* unserialize: Strictly check for `:{` at object start

* unserialize: Update CVE tests

It's unlikely that the object syntax error contributed to the actual CVE. The
CVE is rather caused by the incorrect object serialization data of the `C`
format. Add a second string without such a syntax error to ensure that path is
still executed as well to ensure the CVE is absent.

* Fix test expectation in gmp/tests/bug74670.phpt

No changes to the input required, because the test actually is intended to
verify the behavior for a missing `}`, it's just that the report position changed.

* NEWS

* UPGRADING
2023-01-12 19:55:54 +01:00
..
2021-06-10 17:48:16 +02:00
2021-06-10 14:48:06 +02:00
2021-06-10 14:48:06 +02:00