archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-16588: UAF in Observer->serialize

Browse source 
Closes GH-16600.
This commit is contained in:
Niels Dossche 2024-10-25 19:45:13 +02:00
parent e0a0e216a9
commit 144d2ee29a
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 31 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -102,6 +102,7 @@ PHP NEWS
(ilutov) (ilutov)
. Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov) . Fixed bug GH-16479 (Use-after-free in SplObjectStorage::setInfo()). (ilutov)
. Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()). (ilutov) . Fixed bug GH-16478 (Use-after-free in SplFixedArray::unset()). (ilutov)
. Fixed bug GH-16588 (UAF in Observer->serialize). (nielsdos)
- Standard: - Standard:
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with . Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with

9
ext/spl/spl_observer.c
View file

@ -797,11 +797,18 @@ PHP_METHOD(SplObjectStorage, serialize)
RETURN_NULL(); RETURN_NULL();
} }
ZVAL_OBJ(&obj, element->obj); ZVAL_OBJ(&obj, element->obj);
/* Protect against modification; we need a full copy because the data may be refcounted. */
zval inf_copy;
ZVAL_COPY(&inf_copy, &element->inf);
php_var_serialize(&buf, &obj, &var_hash); php_var_serialize(&buf, &obj, &var_hash);
smart_str_appendc(&buf, ','); smart_str_appendc(&buf, ',');
php_var_serialize(&buf, &element->inf, &var_hash); php_var_serialize(&buf, &inf_copy, &var_hash);
smart_str_appendc(&buf, ';'); smart_str_appendc(&buf, ';');
zend_hash_move_forward_ex(&intern->storage, &pos); zend_hash_move_forward_ex(&intern->storage, &pos);
zval_ptr_dtor(&inf_copy);
} }
/* members */ /* members */

22
ext/spl/tests/gh16588.phpt Normal file
View file

@ -0,0 +1,22 @@
--TEST--
GH-16588 (UAF in Observer->serialize)
--CREDITS--
chibinz
--FILE--
<?php
class C {
function __serialize(): array {
global $store;
$store->removeAll($store);
return [];
}
}
$store = new SplObjectStorage;
$store[new C] = new stdClass;
var_dump($store->serialize());
?>
--EXPECT--
string(47) "x:i:1;O:1:"C":0:{},O:8:"stdClass":0:{};m:a:0:{}"