mirror of
https://github.com/php/php-src.git
synced 2025-08-16 05:58:45 +02:00
f2e8c5da90
* unserialize: Strictly check for `:{` at object start
* unserialize: Update CVE tests
It's unlikely that the object syntax error contributed to the actual CVE. The
CVE is rather caused by the incorrect object serialization data of the `C`
format. Add a second string without such a syntax error to ensure that path is
still executed as well to ensure the CVE is absent.
* Fix test expectation in gmp/tests/bug74670.phpt
No changes to the input required, because the test actually is intended to
verify the behavior for a missing `}`, it's just that the report position changed.
* NEWS
* UPGRADING
|
||
|---|---|---|
| .. | ||
| tests | ||
| config.m4 | ||
| config.w32 | ||
| CREDITS | ||
| gmp.c | ||
| gmp.stub.php | ||
| gmp_arginfo.h | ||
| php_gmp.h | ||
| php_gmp_int.h | ||