Skip to content

Commit

Permalink
Make HashContexts serializable.
Browse files Browse the repository at this point in the history
* Modify php_hash_ops to contain the algorithm name and
  serialize and unserialize methods.

* Implement __serialize and __unserialize magic methods on
  HashContext.

Note that serialized HashContexts are not necessarily portable
between PHP versions or from architecture to architecture.
(Most are, though Keccak and slow SHA3s are not.)

An exception is thrown when an unsupported serialization is
attempted.

Because of security concerns, HASH_HMAC contexts are not
currently serializable; attempting to serialize one throws
an exception.

Serialization exposes the state of HashContext memory, so ensure
that memory is zeroed before use by allocating it with a new
php_hash_alloc_context function. Performance impact is
negligible.

Some hash internal states have logical pointers into a buffer,
or sponge, that absorbs input provided in bytes rather than
chunks. The unserialize functions for these hash functions
must validate that the logical pointers are all within bounds,
lest future hash operations cause out-of-bounds memory accesses.

* Adler32, CRC32, FNV, joaat: simple state, no buffer positions
* Gost, MD2, SHA3, Snefru, Tiger, Whirlpool: buffer positions
  must be validated
* MD4, MD5, SHA1, SHA2, haval, ripemd: buffer positions encoded
  bitwise, forced to within bounds on use; no need to validate
  • Loading branch information
kohler authored and nikic committed Jun 30, 2020
1 parent dc85be5 commit ada776c
Show file tree
Hide file tree
Showing 40 changed files with 1,524 additions and 56 deletions.
10 changes: 7 additions & 3 deletions UPGRADING
Expand Up @@ -568,14 +568,18 @@ PHP 8.0 UPGRADE NOTES
. Added DateTime::createFromInterface() and
DateTimeImmutable::createFromInterface().

- Dom:
. Introduce DOMParentNode and DOMChildNode with new traversal and
manipulation APIs.
RFC: https://wiki.php.net/rfc/dom_living_standard_api

- Enchant:
. enchant_dict_add()
. enchant_dict_is_added()
. LIBENCHANT_VERSION macro

- dom:
. Introduce DOMParentNode and DOMChildNode with new traversal and manipulation APIs
RFC: https://wiki.php.net/rfc/dom_living_standard_api
- Hash:
. HashContext objects can now be serialized.

- Opcache:
. If the opcache.record_warnings ini setting is enabled, opcache will record
Expand Down

0 comments on commit ada776c

Please sign in to comment.