php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.5'

Browse Source 
* PHP-8.5:
  Improve __unserialize() hardening for SplHeap/SplPriorityQueue
This commit is contained in:
Niels Dossche
2025-10-11 23:52:47 +02:00
parent 677c7fe31b bc76b3fca9
commit 0583cce838
2 changed files with 34 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ext/spl/spl_heap.c
View File

@@ -1257,6 +1257,10 @@ PHP_METHOD(SplHeap, __unserialize)
Z_PARAM_ARRAY_HT(data)
ZEND_PARSE_PARAMETERS_END();
if (UNEXPECTED(spl_heap_consistency_validations(intern, true) != SUCCESS)) {
RETURN_THROWS();
}
if (zend_hash_num_elements(data) != 2) {
zend_throw_exception_ex(NULL, 0, "Invalid serialization data for %s object", ZSTR_VAL(intern->std.ce->name));
RETURN_THROWS();
@@ -1285,10 +1289,6 @@ PHP_METHOD(SplHeap, __unserialize)
RETURN_THROWS();
}
if (EG(exception)) {
RETURN_THROWS();
}
if (UNEXPECTED(spl_heap_consistency_validations(intern, false) != SUCCESS)) {
RETURN_THROWS();
}

30
ext/spl/tests/heap_unserialize_under_corruption_or_modification.phpt Normal file
View File

@@ -0,0 +1,30 @@
--TEST--
SplHeap should not accept unserialize data when it is corrupted or under modification
--FILE--
<?php
class MyHeap extends SplMaxHeap {
public function compare($a, $b): int {
global $array;
static $counter = 0;
if ($counter++ === 0)
$this->__unserialize($array);
return $a < $b ? -1 : ($a == $b ? 0 : 1);
}
}
$heap = new SplMaxHeap;
$heap->insert(1);
$array = $heap->__serialize();
$heap = new MyHeap;
$heap->insert(0);
try {
$heap->insert(2);
} catch (RuntimeException $e) {
echo $e->getMessage(), "\n";
}
?>
--EXPECT--
Heap cannot be changed when it is already being modified.