archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-18 15:08:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Better fix for bug #67072 with more BC provisions

Browse source
This commit is contained in:
Stanislav Malyshev 2014-06-21 21:28:33 -07:00
parent f0639611cf
commit 342240fd7f
4 changed files with 121 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -18,7 +18,7 @@ PHP NEWS
?? ??? 2014, PHP 5.5.14 ?? ??? 2014, PHP 5.5.14
- Core: - Core:
. Fixed BC break introduced by patch for bug #67072. (Anatol) . Fixed BC break introduced by patch for bug #67072. (Anatol, Stas)
. Fixed bug #66622 (Closures do not correctly capture the late bound class . Fixed bug #66622 (Closures do not correctly capture the late bound class
(static::) in some cases). (Levi Morrison) (static::) in some cases). (Levi Morrison)
. Fixed bug #67390 (insecure temporary file use in the configure script). . Fixed bug #67390 (insecure temporary file use in the configure script).

84
ext/standard/tests/serialize/bug67072_2.phpt Normal file
View file

@ -0,0 +1,84 @@
--TEST--
Bug #67072 Echoing unserialized "SplFileObject" crash - BC break fixes
--FILE--
<?php
class MySplFileObject extends SplFileObject {}
class MyArrayObject extends ArrayObject{ var $a = 1; }
echo unserialize('O:15:"MySplFileObject":1:{s:9:"*filename";s:15:"/home/flag/flag";}');
function testClass($className)
{
// simulate phpunit
$object = unserialize(sprintf('O:%d:"%s":0:{}', strlen($className), $className));
return $object;
}
class MyClass {}
class MyClassSer implements Serializable {
function serialize() { return "";}
function unserialize($data) { }
}
class MyClassSer2 extends MyClassSer {
}
$classes = array('stdClass', 'MyClass', 'MyClassSer', 'MyClassSer2', 'SplFileObject', 'MySplFileObject',
'SplObjectStorage', 'FooBar', 'Closure', 'ArrayObject', 'MyArrayObject',
'Directory'
);
foreach($classes as $cl) {
var_dump(testClass($cl));
}
?>
===DONE==
--EXPECTF--
Warning: Erroneous data format for unserializing 'MySplFileObject' in %s on line 4
Notice: unserialize(): Error at offset 26 of 66 bytes in %s on line 4
object(stdClass)#%d (0) {
}
object(MyClass)#%d (0) {
}
object(MyClassSer)#%d (0) {
}
object(MyClassSer2)#%d (0) {
}
Warning: Erroneous data format for unserializing 'SplFileObject' in %s on line 9
Notice: unserialize(): Error at offset 24 of 25 bytes in %s on line 9
bool(false)
Warning: Erroneous data format for unserializing 'MySplFileObject' in %s on line 9
Notice: unserialize(): Error at offset 26 of 27 bytes in %s on line 9
bool(false)
object(SplObjectStorage)#%d (1) {
["storage":"SplObjectStorage":private]=>
array(0) {
}
}
object(__PHP_Incomplete_Class)#%d (1) {
["__PHP_Incomplete_Class_Name"]=>
string(6) "FooBar"
}
Warning: Erroneous data format for unserializing 'Closure' in %s on line 9
Notice: unserialize(): Error at offset 17 of 18 bytes in %s on line 9
bool(false)
object(ArrayObject)#%d (1) {
["storage":"ArrayObject":private]=>
array(0) {
}
}
object(MyArrayObject)#1 (2) {
["a"]=>
int(1)
["storage":"ArrayObject":private]=>
array(0) {
}
}
object(Directory)#1 (0) {
}
===DONE==

67
ext/standard/var_unserializer.c
View file

@ -1,4 +1,4 @@
/* Generated by re2c 0.13.5 on Tue Jun 3 10:23:35 2014 */ /* Generated by re2c 0.13.5 on Sat Jun 21 21:27:56 2014 */
#line 1 "ext/standard/var_unserializer.re" #line 1 "ext/standard/var_unserializer.re"
/* /*
+----------------------------------------------------------------------+ +----------------------------------------------------------------------+
@ -23,6 +23,7 @@
#include "php.h" #include "php.h"
#include "ext/standard/php_var.h" #include "ext/standard/php_var.h"
#include "php_incomplete_class.h" #include "php_incomplete_class.h"
#include "Zend/zend_interfaces.h"
/* {{{ reference-handling for unserializer: var_* */ /* {{{ reference-handling for unserializer: var_* */
#define VAR_ENTRIES_MAX 1024 #define VAR_ENTRIES_MAX 1024
@ -226,7 +227,7 @@ static char *unserialize_str(const unsigned char **p, size_t *len, size_t maxlen
#define YYMARKER marker #define YYMARKER marker
#line 234 "ext/standard/var_unserializer.re" #line 235 "ext/standard/var_unserializer.re"
@ -400,7 +401,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
Serializable interface have eventually an inconsistent behavior at this place when Serializable interface have eventually an inconsistent behavior at this place when
unserialized from a manipulated string. Additionaly the interal classes can possibly unserialized from a manipulated string. Additionaly the interal classes can possibly
crash PHP so they're still disabled here. */ crash PHP so they're still disabled here. */
if (ce->serialize == NULL || ZEND_INTERNAL_CLASS != ce->type) { if (ce->serialize == NULL || ce->unserialize == zend_user_unserialize || (ZEND_INTERNAL_CLASS != ce->type && ce->create_object == NULL)) {
object_init_ex(*rval, ce); object_init_ex(*rval, ce);
} else { } else {
/* If this class implements Serializable, it should not land here but in object_custom(). The passed string /* If this class implements Serializable, it should not land here but in object_custom(). The passed string
@ -473,7 +474,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
#line 477 "ext/standard/var_unserializer.c" #line 478 "ext/standard/var_unserializer.c"
{ {
YYCTYPE yych; YYCTYPE yych;
static const unsigned char yybm[] = { static const unsigned char yybm[] = {
@ -533,9 +534,9 @@ yy2:
yych = *(YYMARKER = ++YYCURSOR); yych = *(YYMARKER = ++YYCURSOR);
if (yych == ':') goto yy95; if (yych == ':') goto yy95;
yy3: yy3:
#line 828 "ext/standard/var_unserializer.re" #line 829 "ext/standard/var_unserializer.re"
{ return 0; } { return 0; }
#line 539 "ext/standard/var_unserializer.c" #line 540 "ext/standard/var_unserializer.c"
yy4: yy4:
yych = *(YYMARKER = ++YYCURSOR); yych = *(YYMARKER = ++YYCURSOR);
if (yych == ':') goto yy89; if (yych == ':') goto yy89;
@ -578,13 +579,13 @@ yy13:
goto yy3; goto yy3;
yy14: yy14:
++YYCURSOR; ++YYCURSOR;
#line 822 "ext/standard/var_unserializer.re" #line 823 "ext/standard/var_unserializer.re"
{ {
/* this is the case where we have less data than planned */ /* this is the case where we have less data than planned */
php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data"); php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
return 0; /* not sure if it should be 0 or 1 here? */ return 0; /* not sure if it should be 0 or 1 here? */
} }
#line 588 "ext/standard/var_unserializer.c" #line 589 "ext/standard/var_unserializer.c"
yy16: yy16:
yych = *++YYCURSOR; yych = *++YYCURSOR;
goto yy3; goto yy3;
@ -614,7 +615,7 @@ yy20:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych != '"') goto yy18; if (yych != '"') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 676 "ext/standard/var_unserializer.re" #line 677 "ext/standard/var_unserializer.re"
{ {
size_t len, len2, len3, maxlen; size_t len, len2, len3, maxlen;
long elements; long elements;
@ -760,7 +761,7 @@ yy20:
return object_common2(UNSERIALIZE_PASSTHRU, elements); return object_common2(UNSERIALIZE_PASSTHRU, elements);
} }
#line 764 "ext/standard/var_unserializer.c" #line 765 "ext/standard/var_unserializer.c"
yy25: yy25:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych <= ',') { if (yych <= ',') {
@ -785,7 +786,7 @@ yy27:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych != '"') goto yy18; if (yych != '"') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 668 "ext/standard/var_unserializer.re" #line 669 "ext/standard/var_unserializer.re"
{ {
INIT_PZVAL(*rval); INIT_PZVAL(*rval);
@ -793,7 +794,7 @@ yy27:
return object_common2(UNSERIALIZE_PASSTHRU, return object_common2(UNSERIALIZE_PASSTHRU,
object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR)); object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
} }
#line 797 "ext/standard/var_unserializer.c" #line 798 "ext/standard/var_unserializer.c"
yy32: yy32:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych == '+') goto yy33; if (yych == '+') goto yy33;
@ -814,7 +815,7 @@ yy34:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych != '{') goto yy18; if (yych != '{') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 648 "ext/standard/var_unserializer.re" #line 649 "ext/standard/var_unserializer.re"
{ {
long elements = parse_iv(start + 2); long elements = parse_iv(start + 2);
/* use iv() not uiv() in order to check data range */ /* use iv() not uiv() in order to check data range */
@ -834,7 +835,7 @@ yy34:
return finish_nested_data(UNSERIALIZE_PASSTHRU); return finish_nested_data(UNSERIALIZE_PASSTHRU);
} }
#line 838 "ext/standard/var_unserializer.c" #line 839 "ext/standard/var_unserializer.c"
yy39: yy39:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych == '+') goto yy40; if (yych == '+') goto yy40;
@ -855,7 +856,7 @@ yy41:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych != '"') goto yy18; if (yych != '"') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 619 "ext/standard/var_unserializer.re" #line 620 "ext/standard/var_unserializer.re"
{ {
size_t len, maxlen; size_t len, maxlen;
char *str; char *str;
@ -884,7 +885,7 @@ yy41:
ZVAL_STRINGL(*rval, str, len, 0); ZVAL_STRINGL(*rval, str, len, 0);
return 1; return 1;
} }
#line 888 "ext/standard/var_unserializer.c" #line 889 "ext/standard/var_unserializer.c"
yy46: yy46:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych == '+') goto yy47; if (yych == '+') goto yy47;
@ -905,7 +906,7 @@ yy48:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych != '"') goto yy18; if (yych != '"') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 591 "ext/standard/var_unserializer.re" #line 592 "ext/standard/var_unserializer.re"
{ {
size_t len, maxlen; size_t len, maxlen;
char *str; char *str;
@ -933,7 +934,7 @@ yy48:
ZVAL_STRINGL(*rval, str, len, 1); ZVAL_STRINGL(*rval, str, len, 1);
return 1; return 1;
} }
#line 937 "ext/standard/var_unserializer.c" #line 938 "ext/standard/var_unserializer.c"
yy53: yy53:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych <= '/') { if (yych <= '/') {
@ -1021,7 +1022,7 @@ yy61:
} }
yy63: yy63:
++YYCURSOR; ++YYCURSOR;
#line 581 "ext/standard/var_unserializer.re" #line 582 "ext/standard/var_unserializer.re"
{ {
#if SIZEOF_LONG == 4 #if SIZEOF_LONG == 4
use_double: use_double:
@ -1031,7 +1032,7 @@ use_double:
ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL)); ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
return 1; return 1;
} }
#line 1035 "ext/standard/var_unserializer.c" #line 1036 "ext/standard/var_unserializer.c"
yy65: yy65:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych <= ',') { if (yych <= ',') {
@ -1090,7 +1091,7 @@ yy73:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych != ';') goto yy18; if (yych != ';') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 566 "ext/standard/var_unserializer.re" #line 567 "ext/standard/var_unserializer.re"
{ {
*p = YYCURSOR; *p = YYCURSOR;
INIT_PZVAL(*rval); INIT_PZVAL(*rval);
@ -1105,7 +1106,7 @@ yy73:
return 1; return 1;
} }
#line 1109 "ext/standard/var_unserializer.c" #line 1110 "ext/standard/var_unserializer.c"
yy76: yy76:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych == 'N') goto yy73; if (yych == 'N') goto yy73;
@ -1132,7 +1133,7 @@ yy79:
if (yych <= '9') goto yy79; if (yych <= '9') goto yy79;
if (yych != ';') goto yy18; if (yych != ';') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 539 "ext/standard/var_unserializer.re" #line 540 "ext/standard/var_unserializer.re"
{ {
#if SIZEOF_LONG == 4 #if SIZEOF_LONG == 4
int digits = YYCURSOR - start - 3; int digits = YYCURSOR - start - 3;
@ -1159,7 +1160,7 @@ yy79:
ZVAL_LONG(*rval, parse_iv(start + 2)); ZVAL_LONG(*rval, parse_iv(start + 2));
return 1; return 1;
} }
#line 1163 "ext/standard/var_unserializer.c" #line 1164 "ext/standard/var_unserializer.c"
yy83: yy83:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych <= '/') goto yy18; if (yych <= '/') goto yy18;
@ -1167,24 +1168,24 @@ yy83:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych != ';') goto yy18; if (yych != ';') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 532 "ext/standard/var_unserializer.re" #line 533 "ext/standard/var_unserializer.re"
{ {
*p = YYCURSOR; *p = YYCURSOR;
INIT_PZVAL(*rval); INIT_PZVAL(*rval);
ZVAL_BOOL(*rval, parse_iv(start + 2)); ZVAL_BOOL(*rval, parse_iv(start + 2));
return 1; return 1;
} }
#line 1178 "ext/standard/var_unserializer.c" #line 1179 "ext/standard/var_unserializer.c"
yy87: yy87:
++YYCURSOR; ++YYCURSOR;
#line 525 "ext/standard/var_unserializer.re" #line 526 "ext/standard/var_unserializer.re"
{ {
*p = YYCURSOR; *p = YYCURSOR;
INIT_PZVAL(*rval); INIT_PZVAL(*rval);
ZVAL_NULL(*rval); ZVAL_NULL(*rval);
return 1; return 1;
} }
#line 1188 "ext/standard/var_unserializer.c" #line 1189 "ext/standard/var_unserializer.c"
yy89: yy89:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych <= ',') { if (yych <= ',') {
@ -1207,7 +1208,7 @@ yy91:
if (yych <= '9') goto yy91; if (yych <= '9') goto yy91;
if (yych != ';') goto yy18; if (yych != ';') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 502 "ext/standard/var_unserializer.re" #line 503 "ext/standard/var_unserializer.re"
{ {
long id; long id;
@ -1230,7 +1231,7 @@ yy91:
return 1; return 1;
} }
#line 1234 "ext/standard/var_unserializer.c" #line 1235 "ext/standard/var_unserializer.c"
yy95: yy95:
yych = *++YYCURSOR; yych = *++YYCURSOR;
if (yych <= ',') { if (yych <= ',') {
@ -1253,7 +1254,7 @@ yy97:
if (yych <= '9') goto yy97; if (yych <= '9') goto yy97;
if (yych != ';') goto yy18; if (yych != ';') goto yy18;
++YYCURSOR; ++YYCURSOR;
#line 481 "ext/standard/var_unserializer.re" #line 482 "ext/standard/var_unserializer.re"
{ {
long id; long id;
@ -1274,9 +1275,9 @@ yy97:
return 1; return 1;
} }
#line 1278 "ext/standard/var_unserializer.c" #line 1279 "ext/standard/var_unserializer.c"
} }
#line 830 "ext/standard/var_unserializer.re" #line 831 "ext/standard/var_unserializer.re"
return 0; return 0;

3
ext/standard/var_unserializer.re
View file

@ -21,6 +21,7 @@
#include "php.h" #include "php.h"
#include "ext/standard/php_var.h" #include "ext/standard/php_var.h"
#include "php_incomplete_class.h" #include "php_incomplete_class.h"
#include "Zend/zend_interfaces.h"
/* {{{ reference-handling for unserializer: var_* */ /* {{{ reference-handling for unserializer: var_* */
#define VAR_ENTRIES_MAX 1024 #define VAR_ENTRIES_MAX 1024
@ -404,7 +405,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
Serializable interface have eventually an inconsistent behavior at this place when Serializable interface have eventually an inconsistent behavior at this place when
unserialized from a manipulated string. Additionaly the interal classes can possibly unserialized from a manipulated string. Additionaly the interal classes can possibly
crash PHP so they're still disabled here. */ crash PHP so they're still disabled here. */
if (ce->serialize == NULL || ZEND_INTERNAL_CLASS != ce->type) { if (ce->serialize == NULL || ce->unserialize == zend_user_unserialize || (ZEND_INTERNAL_CLASS != ce->type && ce->create_object == NULL)) {
object_init_ex(*rval, ce); object_init_ex(*rval, ce);
} else { } else {
/* If this class implements Serializable, it should not land here but in object_custom(). The passed string /* If this class implements Serializable, it should not land here but in object_custom(). The passed string