archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-8.2' into PHP-8.3

Browse source 
* PHP-8.2:
  Fix GH-16589: UAF in SplDoublyLinked->serialize()
This commit is contained in:
Niels Dossche 2024-10-27 19:12:02 +01:00
commit d9947e8c42
No known key found for this signature in database
GPG key ID: B8A8AD166DF0E2E5
3 changed files with 32 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
NEWS
View file

@ -112,6 +112,7 @@ PHP NEWS
. Fixed bug GH-16588 (UAF in Observer->serialize). (nielsdos)
. Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed
SplFileObject::__constructor). (Girgias)
. Fixed bug GH-16589 (UAF in SplDoublyLinked->serialize()). (nielsdos)
- Standard:
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with

9
ext/spl/spl_dllist.c
View file

@ -44,10 +44,13 @@ PHPAPI zend_class_entry *spl_ce_SplStack;
efree(elem); \
}
#define SPL_LLIST_CHECK_DELREF(elem) if ((elem) && !--SPL_LLIST_RC(elem)) { \
#define SPL_LLIST_CHECK_DELREF_EX(elem, on_free) if ((elem) && !--SPL_LLIST_RC(elem)) { \
efree(elem); \
on_free \
}
#define SPL_LLIST_CHECK_DELREF(elem) SPL_LLIST_CHECK_DELREF_EX(elem, ;)
#define SPL_LLIST_ADDREF(elem) SPL_LLIST_RC(elem)++
#define SPL_LLIST_CHECK_ADDREF(elem) if (elem) SPL_LLIST_RC(elem)++
@ -1023,8 +1026,12 @@ PHP_METHOD(SplDoublyLinkedList, serialize)
smart_str_appendc(&buf, ':');
next = current->next;
SPL_LLIST_CHECK_ADDREF(next);
php_var_serialize(&buf, &current->data, &var_hash);
SPL_LLIST_CHECK_DELREF_EX(next, break;);
current = next;
}

23
ext/spl/tests/gh16589.phpt Normal file
View file

@ -0,0 +1,23 @@
--TEST--
GH-16589 (UAF in SplDoublyLinked->serialize())
--CREDITS--
chibinz
--FILE--
<?php
class C {
function __serialize(): array {
global $list;
$list->pop();
return [];
}
}
$list = new SplDoublyLinkedList;
$list->add(0, new C);
$list->add(1, 1);
var_dump($list->serialize());
?>
--EXPECT--
string(17) "i:0;:O:1:"C":0:{}"