|
 |
e9ca13 |
From 51c38a09970c1f8395e68500c0b2ed1b3c9a6786 Mon Sep 17 00:00:00 2001
|
|
|
e9ca13 |
From: Xinchen Hui <laruence@php.net>
|
|
|
e9ca13 |
Date: Wed, 2 Jul 2014 17:57:42 +0800
|
|
|
e9ca13 |
Subject: [PATCH] Fixed bug #67539 (ArrayIterator use-after-free due to object
|
|
|
e9ca13 |
change during sorting)
|
|
|
e9ca13 |
|
|
|
e9ca13 |
---
|
|
|
e9ca13 |
ext/spl/spl_array.c | 7 +++++++
|
|
|
e9ca13 |
ext/spl/tests/bug67539.phpt | 15 +++++++++++++++
|
|
|
e9ca13 |
2 files changed, 22 insertions(+)
|
|
|
e9ca13 |
create mode 100644 ext/spl/tests/bug67539.phpt
|
|
|
e9ca13 |
|
|
|
e9ca13 |
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
|
|
|
e9ca13 |
index bf034ab..ec9ce21 100644
|
|
|
e9ca13 |
--- a/ext/spl/spl_array.c
|
|
|
e9ca13 |
+++ b/ext/spl/spl_array.c
|
|
|
e9ca13 |
@@ -1726,6 +1726,7 @@ SPL_METHOD(Array, unserialize)
|
|
|
e9ca13 |
const unsigned char *p, *s;
|
|
|
e9ca13 |
php_unserialize_data_t var_hash;
|
|
|
e9ca13 |
zval *pmembers, *pflags = NULL;
|
|
|
e9ca13 |
+ HashTable *aht;
|
|
|
e9ca13 |
long flags;
|
|
|
e9ca13 |
|
|
|
e9ca13 |
if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) {
|
|
|
e9ca13 |
@@ -1737,6 +1738,12 @@ SPL_METHOD(Array, unserialize)
|
|
|
e9ca13 |
return;
|
|
|
e9ca13 |
}
|
|
|
e9ca13 |
|
|
|
e9ca13 |
+ aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
|
|
|
e9ca13 |
+ if (aht->nApplyCount > 0) {
|
|
|
e9ca13 |
+ zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
|
|
|
e9ca13 |
+ return;
|
|
|
e9ca13 |
+ }
|
|
|
e9ca13 |
+
|
|
|
e9ca13 |
/* storage */
|
|
|
e9ca13 |
s = p = (const unsigned char*)buf;
|
|
|
e9ca13 |
PHP_VAR_UNSERIALIZE_INIT(var_hash);
|
|
|
e9ca13 |
diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt
|
|
|
e9ca13 |
new file mode 100644
|
|
|
e9ca13 |
index 0000000..8bab2a8
|
|
|
e9ca13 |
--- /dev/null
|
|
|
e9ca13 |
+++ b/ext/spl/tests/bug67539.phpt
|
|
|
e9ca13 |
@@ -0,0 +1,15 @@
|
|
|
e9ca13 |
+--TEST--
|
|
|
e9ca13 |
+Bug #67539 (ArrayIterator use-after-free due to object change during sorting)
|
|
|
e9ca13 |
+--FILE--
|
|
|
e9ca13 |
+
|
|
|
e9ca13 |
+
|
|
|
e9ca13 |
+$it = new ArrayIterator(array_fill(0,2,'X'), 1 );
|
|
|
e9ca13 |
+
|
|
|
e9ca13 |
+function badsort($a, $b) {
|
|
|
e9ca13 |
+ $GLOBALS['it']->unserialize($GLOBALS['it']->serialize());
|
|
|
e9ca13 |
+ return TRUE;
|
|
|
e9ca13 |
+}
|
|
|
e9ca13 |
+
|
|
|
e9ca13 |
+$it->uksort('badsort');
|
|
|
e9ca13 |
+--EXPECTF--
|
|
|
e9ca13 |
+Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d
|
|
|
e9ca13 |
--
|
|
|
e9ca13 |
2.1.0
|
|
|
e9ca13 |
|