|
 |
20017b |
From 51856a76f87ecb24fe1385342be43610fb6c86e4 Mon Sep 17 00:00:00 2001
|
|
|
20017b |
From: Dmitry Stogov <dmitry@zend.com>
|
|
|
20017b |
Date: Thu, 19 Mar 2015 11:36:01 +0300
|
|
|
20017b |
Subject: [PATCH] Fixed bug #69152
|
|
|
20017b |
|
|
|
20017b |
---
|
|
|
20017b |
ext/soap/soap.c | 6 ++++++
|
|
|
20017b |
1 file changed, 6 insertions(+)
|
|
|
20017b |
|
|
|
20017b |
diff --git a/ext/soap/soap.c b/ext/soap/soap.c
|
|
|
20017b |
index d460c17..41aa1ad 100644
|
|
|
20017b |
--- a/ext/soap/soap.c
|
|
|
20017b |
+++ b/ext/soap/soap.c
|
|
|
20017b |
@@ -919,6 +919,12 @@ PHP_METHOD(SoapFault, __toString)
|
|
|
20017b |
|
|
|
20017b |
zend_call_function(&fci, NULL TSRMLS_CC);
|
|
|
20017b |
|
|
|
20017b |
+ convert_to_string(faultcode);
|
|
|
20017b |
+ convert_to_string(faultstring);
|
|
|
20017b |
+ convert_to_string(file);
|
|
|
20017b |
+ convert_to_long(line);
|
|
|
20017b |
+ convert_to_string(trace);
|
|
|
20017b |
+
|
|
|
20017b |
len = spprintf(&str, 0, "SoapFault exception: [%s] %s in %s:%ld\nStack trace:\n%s",
|
|
|
20017b |
Z_STRVAL_P(faultcode), Z_STRVAL_P(faultstring), Z_STRVAL_P(file), Z_LVAL_P(line),
|
|
|
20017b |
Z_STRLEN_P(trace) ? Z_STRVAL_P(trace) : "#0 {main}\n");
|
|
|
20017b |
--
|
|
|
20017b |
2.1.4
|
|
|
20017b |
|
|
|
20017b |
From fb83c76deec58f1fab17c350f04c9f042e5977d1 Mon Sep 17 00:00:00 2001
|
|
|
20017b |
From: Stanislav Malyshev <stas@php.net>
|
|
|
20017b |
Date: Sun, 22 Mar 2015 18:17:47 -0700
|
|
|
20017b |
Subject: [PATCH] Check that the type is correct
|
|
|
20017b |
|
|
|
20017b |
---
|
|
|
20017b |
ext/standard/incomplete_class.c | 2 +-
|
|
|
20017b |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
20017b |
|
|
|
20017b |
diff --git a/ext/standard/incomplete_class.c b/ext/standard/incomplete_class.c
|
|
|
20017b |
index 1816ac4..30c82e6 100644
|
|
|
20017b |
--- a/ext/standard/incomplete_class.c
|
|
|
20017b |
+++ b/ext/standard/incomplete_class.c
|
|
|
20017b |
@@ -144,7 +144,7 @@ PHPAPI char *php_lookup_class_name(zval *object, zend_uint *nlen)
|
|
|
20017b |
|
|
|
20017b |
object_properties = Z_OBJPROP_P(object);
|
|
|
20017b |
|
|
|
20017b |
- if (zend_hash_find(object_properties, MAGIC_MEMBER, sizeof(MAGIC_MEMBER), (void **) &val) == SUCCESS) {
|
|
|
20017b |
+ if (zend_hash_find(object_properties, MAGIC_MEMBER, sizeof(MAGIC_MEMBER), (void **) &val) == SUCCESS && Z_TYPE_PP(val) == IS_STRING) {
|
|
|
20017b |
retval = estrndup(Z_STRVAL_PP(val), Z_STRLEN_PP(val));
|
|
|
20017b |
|
|
|
20017b |
if (nlen) {
|
|
|
20017b |
--
|
|
|
20017b |
2.1.4
|
|
|
20017b |
|
|
|
20017b |
From a894a8155fab068d68a04bf181dbaddfa01ccbb0 Mon Sep 17 00:00:00 2001
|
|
|
20017b |
From: Stanislav Malyshev <stas@php.net>
|
|
|
20017b |
Date: Sun, 5 Apr 2015 17:30:59 -0700
|
|
|
20017b |
Subject: [PATCH] More fixes for bug #69152
|
|
|
20017b |
|
|
|
20017b |
---
|
|
|
20017b |
Zend/zend_exceptions.c | 3 +++
|
|
|
20017b |
ext/standard/tests/serialize/bug69152.phpt | 16 ++++++++++++++++
|
|
|
20017b |
2 files changed, 19 insertions(+)
|
|
|
20017b |
create mode 100644 ext/standard/tests/serialize/bug69152.phpt
|
|
|
20017b |
|
|
|
20017b |
diff --git a/Zend/zend_exceptions.c b/Zend/zend_exceptions.c
|
|
|
20017b |
index bf90ae7..1ca2ead 100644
|
|
|
20017b |
--- a/Zend/zend_exceptions.c
|
|
|
20017b |
+++ b/Zend/zend_exceptions.c
|
|
|
20017b |
@@ -536,6 +536,9 @@ ZEND_METHOD(exception, getTraceAsString)
|
|
|
20017b |
str = &res;
|
|
|
20017b |
|
|
|
20017b |
trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
|
|
|
20017b |
+ if(Z_TYPE_P(trace) != IS_ARRAY) {
|
|
|
20017b |
+ RETURN_FALSE;
|
|
|
20017b |
+ }
|
|
|
20017b |
zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);
|
|
|
20017b |
|
|
|
20017b |
s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
|
|
|
20017b |
diff --git a/ext/standard/tests/serialize/bug69152.phpt b/ext/standard/tests/serialize/bug69152.phpt
|
|
|
20017b |
new file mode 100644
|
|
|
20017b |
index 0000000..4e74168
|
|
|
20017b |
--- /dev/null
|
|
|
20017b |
+++ b/ext/standard/tests/serialize/bug69152.phpt
|
|
|
20017b |
@@ -0,0 +1,16 @@
|
|
|
20017b |
+--TEST--
|
|
|
20017b |
+Bug #69152: Type Confusion Infoleak Vulnerability in unserialize()
|
|
|
20017b |
+--FILE--
|
|
|
20017b |
+
|
|
|
20017b |
+$x = unserialize('O:9:"exception":1:{s:16:"'."\0".'Exception'."\0".'trace";s:4:"ryat";}');
|
|
|
20017b |
+echo $x;
|
|
|
20017b |
+$x = unserialize('O:4:"test":1:{s:27:"__PHP_Incomplete_Class_Name";R:1;}');
|
|
|
20017b |
+$x->test();
|
|
|
20017b |
+
|
|
|
20017b |
+?>
|
|
|
20017b |
+--EXPECTF--
|
|
|
20017b |
+exception 'Exception' in %s:%d
|
|
|
20017b |
+Stack trace:
|
|
|
20017b |
+#0 {main}
|
|
|
20017b |
+
|
|
|
20017b |
+Fatal error: main(): The script tried to execute a method or access a property of an incomplete object. Please ensure that the class definition "unknown" of the object you are trying to operate on was loaded _before_ unserialize() gets called or provide a __autoload() function to load the class definition in %s on line %d
|
|
|
20017b |
--
|
|
|
20017b |
2.1.4
|
|
|
20017b |
|