diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c index 033d4fa5f0e..3e7d27a3730 100644 --- a/ext/gd/libgd/gd.c +++ b/ext/gd/libgd/gd.c @@ -1117,7 +1117,7 @@ void gdImageLine (gdImagePtr im, int x1, int y1, int x2, int y2, int color) } /* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */ - if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) { + if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) { return; } @@ -1301,55 +1301,10 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col) long x, y, inc, frac; long dx, dy,tmp; - if (y1 < 0 && y2 < 0) { + /* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */ + if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) { return; } - if (y1 < 0) { - x1 += (y1 * (x1 - x2)) / (y2 - y1); - y1 = 0; - } - if (y2 < 0) { - x2 += (y2 * (x1 - x2)) / (y2 - y1); - y2 = 0; - } - - /* bottom edge */ - if (y1 >= im->sy && y2 >= im->sy) { - return; - } - if (y1 >= im->sy) { - x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1); - y1 = im->sy - 1; - } - if (y2 >= im->sy) { - x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1); - y2 = im->sy - 1; - } - - /* left edge */ - if (x1 < 0 && x2 < 0) { - return; - } - if (x1 < 0) { - y1 += (x1 * (y1 - y2)) / (x2 - x1); - x1 = 0; - } - if (x2 < 0) { - y2 += (x2 * (y1 - y2)) / (x2 - x1); - x2 = 0; - } - /* right edge */ - if (x1 >= im->sx && x2 >= im->sx) { - return; - } - if (x1 >= im->sx) { - y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1); - x1 = im->sx - 1; - } - if (x2 >= im->sx) { - y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1); - x2 = im->sx - 1; - } dx = x2 - x1; dy = y2 - y1; @@ -1792,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color) int leftLimit = -1, rightLimit; int i, restoreAlphaBlending = 0; - if (border < 0) { + if (border < 0 || color < 0) { /* Refuse to fill to a non-solid border */ return; } diff --git a/ext/gd/tests/bug72482.phpt b/ext/gd/tests/bug72482.phpt new file mode 100644 index 00000000000..548921d559f --- /dev/null +++ b/ext/gd/tests/bug72482.phpt @@ -0,0 +1,19 @@ +--TEST-- +Bug #72482 (Ilegal write/read access caused by gdImageAALine overflow) +--SKIPIF-- + +--FILE-- + +===DONE=== +--EXPECT-- +===DONE=== diff --git a/ext/gd/tests/bug72482_2.phpt b/ext/gd/tests/bug72482_2.phpt new file mode 100644 index 00000000000..a8a08faa53d --- /dev/null +++ b/ext/gd/tests/bug72482_2.phpt @@ -0,0 +1,21 @@ +--TEST-- +Bug 72482 (Ilegal write/read access caused by gdImageAALine overflow) +--SKIPIF-- + +--FILE-- + +===DONE=== +--EXPECT-- +The images are equal. +===DONE=== diff --git a/ext/gd/tests/bug72482_2.png b/ext/gd/tests/bug72482_2.png new file mode 100644 index 00000000000..da90b2a2670 Binary files /dev/null and b/ext/gd/tests/bug72482_2.png differ diff --git a/ext/gd/tests/bug72696.phpt b/ext/gd/tests/bug72696.phpt new file mode 100644 index 00000000000..4f0d9e7f1d2 --- /dev/null +++ b/ext/gd/tests/bug72696.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #72696 (imagefilltoborder stackoverflow on truecolor images) +--SKIPIF-- + +--FILE-- + +===DONE=== +--EXPECT-- +===DONE=== diff --git a/ext/imap/php_imap.c b/ext/imap/php_imap.c index 8e70163bc62..00eae89a963 100644 --- a/ext/imap/php_imap.c +++ b/ext/imap/php_imap.c @@ -3900,7 +3900,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char * char *tsm_errmsg = NULL; ADDRESS *addr; char *bufferTo = NULL, *bufferCc = NULL, *bufferBcc = NULL, *bufferHeader = NULL; - int offset, bufferLen = 0; + size_t offset, bufferLen = 0; size_t bt_len; if (headers) { diff --git a/ext/pdo/pdo_stmt.c b/ext/pdo/pdo_stmt.c index f5c295c26c3..9f9ada9be3b 100644 --- a/ext/pdo/pdo_stmt.c +++ b/ext/pdo/pdo_stmt.c @@ -2338,6 +2338,7 @@ void pdo_stmt_init(TSRMLS_D) pdo_row_ce->ce_flags |= ZEND_ACC_FINAL_CLASS; /* when removing this a lot of handlers need to be redone */ pdo_row_ce->create_object = pdo_row_new; pdo_row_ce->serialize = pdo_row_serialize; + pdo_row_ce->unserialize = zend_class_unserialize_deny; } static void free_statement(pdo_stmt_t *stmt TSRMLS_DC) diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c index 700d6093dd5..e7cbd1fef15 100644 --- a/ext/spl/spl_array.c +++ b/ext/spl/spl_array.c @@ -1812,7 +1812,7 @@ SPL_METHOD(Array, unserialize) ALLOC_INIT_ZVAL(intern->array); if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC) || (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) { - zval_ptr_dtor(&intern->array); + // zval_ptr_dtor(&intern->array); goto outexcept; } var_push_dtor(&var_hash, &intern->array); diff --git a/ext/standard/tests/serialize/bug73341.phpt b/ext/standard/tests/serialize/bug73341.phpt new file mode 100644 index 00000000000..55423217c31 --- /dev/null +++ b/ext/standard/tests/serialize/bug73341.phpt @@ -0,0 +1,24 @@ +--TEST-- +Bug #73144 (Use-afte-free in ArrayObject Deserialization) +--FILE-- +getMessage()."\n"; +} + +try { +$inner = 'x:i:1;O:8:"stdClass":1:{};m:a:0:{}'; +$exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}'; +unserialize($exploit); +} catch(Exception $e) { + echo $e->getMessage()."\n"; +} +?> +--EXPECTF-- +Error at offset 6 of 7 bytes + +Notice: ArrayObject::unserialize(): Unexpected end of serialized data in %sbug73341.php on line %d +Error at offset 24 of 34 bytes \ No newline at end of file diff --git a/ext/wddx/tests/bug45901.phpt b/ext/wddx/tests/bug45901.phpt index 4084ccbf202..e76e47eab72 100644 --- a/ext/wddx/tests/bug45901.phpt +++ b/ext/wddx/tests/bug45901.phpt @@ -14,5 +14,7 @@ echo wddx_serialize_value($xml, 'Variables') . "\n"; echo "DONE"; ?> --EXPECTF-- -
Variables
SimpleXMLElementSimpleXMLElement + +Warning: wddx_serialize_value(): Class SimpleXMLElement can not be serialized in %sbug45901.php on line %d +
Variables
 DONE \ No newline at end of file diff --git a/ext/wddx/tests/bug72790.phpt b/ext/wddx/tests/bug72790.phpt index a60524bdaf1..3b08e58cc68 100644 --- a/ext/wddx/tests/bug72790.phpt +++ b/ext/wddx/tests/bug72790.phpt @@ -1,5 +1,5 @@ --TEST-- -Bug 72790: wddx_deserialize null dereference with invalid xml +Bug #72790: wddx_deserialize null dereference with invalid xml --SKIPIF-- +--FILE-- +
PDORow"; +var_dump(wddx_deserialize($wddx)); +?> +--EXPECTF-- + +Warning: wddx_deserialize(): Class pdorow can not be unserialized in %s73331.php on line %d +NULL + diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c index 0e77826ce84..59cc8ddda8a 100644 --- a/ext/wddx/wddx.c +++ b/ext/wddx/wddx.c @@ -471,21 +471,26 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj) ulong idx; char tmp_buf[WDDX_BUF_LEN]; HashTable *objhash, *sleephash; + zend_class_entry *ce; + PHP_CLASS_ATTRIBUTES; TSRMLS_FETCH(); + PHP_SET_CLASS_ATTRIBUTES(obj); + ce = Z_OBJCE_P(obj); + if (!ce || ce->serialize || ce->unserialize) { + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Class %s can not be serialized", class_name); + PHP_CLEANUP_CLASS_ATTRIBUTES(); + return; + } + MAKE_STD_ZVAL(fname); ZVAL_STRING(fname, "__sleep", 1); - /* * We try to call __sleep() method on object. It's supposed to return an * array of property names to be serialized. */ if (call_user_function_ex(CG(function_table), &obj, fname, &retval, 0, 0, 1, NULL TSRMLS_CC) == SUCCESS) { if (retval && (sleephash = HASH_OF(retval))) { - PHP_CLASS_ATTRIBUTES; - - PHP_SET_CLASS_ATTRIBUTES(obj); - php_wddx_add_chunk_static(packet, WDDX_STRUCT_S); snprintf(tmp_buf, WDDX_BUF_LEN, WDDX_VAR_S, PHP_CLASS_NAME_VAR); php_wddx_add_chunk(packet, tmp_buf); @@ -494,8 +499,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj) php_wddx_add_chunk_static(packet, WDDX_STRING_E); php_wddx_add_chunk_static(packet, WDDX_VAR_E); - PHP_CLEANUP_CLASS_ATTRIBUTES(); - objhash = HASH_OF(obj); for (zend_hash_internal_pointer_reset(sleephash); @@ -516,10 +519,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj) } else { uint key_len; - PHP_CLASS_ATTRIBUTES; - - PHP_SET_CLASS_ATTRIBUTES(obj); - php_wddx_add_chunk_static(packet, WDDX_STRUCT_S); snprintf(tmp_buf, WDDX_BUF_LEN, WDDX_VAR_S, PHP_CLASS_NAME_VAR); php_wddx_add_chunk(packet, tmp_buf); @@ -528,8 +527,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj) php_wddx_add_chunk_static(packet, WDDX_STRING_E); php_wddx_add_chunk_static(packet, WDDX_VAR_E); - PHP_CLEANUP_CLASS_ATTRIBUTES(); - objhash = HASH_OF(obj); for (zend_hash_internal_pointer_reset(objhash); zend_hash_get_current_data(objhash, (void**)&ent) == SUCCESS; @@ -551,6 +548,8 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj) php_wddx_add_chunk_static(packet, WDDX_STRUCT_E); } + PHP_CLEANUP_CLASS_ATTRIBUTES(); + zval_dtor(fname); FREE_ZVAL(fname); @@ -1012,26 +1011,30 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name) pce = &PHP_IC_ENTRY; } - /* Initialize target object */ - MAKE_STD_ZVAL(obj); - object_init_ex(obj, *pce); + if (pce != &PHP_IC_ENTRY && ((*pce)->serialize || (*pce)->unserialize)) { + ent2->data = NULL; + php_error_docref(NULL TSRMLS_CC, E_WARNING, "Class %s can not be unserialized", Z_STRVAL_P(ent1->data)); + } else { + /* Initialize target object */ + MAKE_STD_ZVAL(obj); + object_init_ex(obj, *pce); - /* Merge current hashtable with object's default properties */ - zend_hash_merge(Z_OBJPROP_P(obj), - Z_ARRVAL_P(ent2->data), - (void (*)(void *)) zval_add_ref, - (void *) &tmp, sizeof(zval *), 0); + /* Merge current hashtable with object's default properties */ + zend_hash_merge(Z_OBJPROP_P(obj), + Z_ARRVAL_P(ent2->data), + (void (*)(void *)) zval_add_ref, + (void *) &tmp, sizeof(zval *), 0); - if (incomplete_class) { - php_store_class_name(obj, Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data)); + if (incomplete_class) { + php_store_class_name(obj, Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data)); + } + + /* Clean up old array entry */ + zval_ptr_dtor(&ent2->data); + + /* Set stack entry to point to the newly created object */ + ent2->data = obj; } - - /* Clean up old array entry */ - zval_ptr_dtor(&ent2->data); - - /* Set stack entry to point to the newly created object */ - ent2->data = obj; - /* Clean up class name var entry */ zval_ptr_dtor(&ent1->data); } else if (Z_TYPE_P(ent2->data) == IS_OBJECT) {