b77848
From 22882a9d89712ff2b6ebc20a689a89452bba4dcd Mon Sep 17 00:00:00 2001
b77848
From: Xinchen Hui <laruence@php.net>
b77848
Date: Wed, 2 Jul 2014 17:57:42 +0800
b77848
Subject: [PATCH] Fixed bug #67539 (ArrayIterator use-after-free due to object
b77848
 change during sorting)
b77848
b77848
---
b77848
 NEWS                        |  2 ++
b77848
 ext/spl/spl_array.c         |  7 +++++++
b77848
 ext/spl/tests/bug67539.phpt | 15 +++++++++++++++
b77848
 3 files changed, 24 insertions(+)
b77848
 create mode 100644 ext/spl/tests/bug67539.phpt
b77848
b77848
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
b77848
index 8392e72..0fe47b6 100644
b77848
--- a/ext/spl/spl_array.c
b77848
+++ b/ext/spl/spl_array.c
b77848
@@ -1738,6 +1738,7 @@ SPL_METHOD(Array, unserialize)
b77848
 	const unsigned char *p, *s;
b77848
 	php_unserialize_data_t var_hash;
b77848
 	zval *pmembers, *pflags = NULL;
b77848
+	HashTable *aht;
b77848
 	long flags;
b77848
 	
b77848
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) {
b77848
@@ -1749,6 +1750,12 @@ SPL_METHOD(Array, unserialize)
b77848
 		return;
b77848
 	}
b77848
 
b77848
+	aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
b77848
+	if (aht->nApplyCount > 0) {
b77848
+		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
b77848
+		return;
b77848
+	}
b77848
+
b77848
 	/* storage */
b77848
 	s = p = (const unsigned char*)buf;
b77848
 	PHP_VAR_UNSERIALIZE_INIT(var_hash);
b77848
diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt
b77848
new file mode 100644
b77848
index 0000000..8bab2a8
b77848
--- /dev/null
b77848
+++ b/ext/spl/tests/bug67539.phpt
b77848
@@ -0,0 +1,15 @@
b77848
+--TEST--
b77848
+Bug #67539 (ArrayIterator use-after-free due to object change during sorting)
b77848
+--FILE--
b77848
+
b77848
+
b77848
+$it = new ArrayIterator(array_fill(0,2,'X'), 1 );
b77848
+
b77848
+function badsort($a, $b) {
b77848
+        $GLOBALS['it']->unserialize($GLOBALS['it']->serialize());
b77848
+        return TRUE;
b77848
+}
b77848
+
b77848
+$it->uksort('badsort');
b77848
+--EXPECTF--
b77848
+Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d
b77848
-- 
b77848
1.9.2
b77848