Skip to content

Commit

Permalink
Fixed bug #74101 and bug #74614
Browse files Browse the repository at this point in the history
  • Loading branch information
@nikic @weltling
nikic authored and weltling committed Jul 4, 2017
1 parent d0b7eed commit d02f953
Show file tree
Hide file tree
Showing 4 changed files with 62 additions and 34 deletions.
10 changes: 10 additions & 0 deletions ext/standard/tests/serialize/bug74101.phpt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
--TEST--
Bug #74101: Unserialize Heap Use-After-Free (READ: 1) in zval_get_type
--FILE--
<?php
$s = 'O:9:"Exception":799999999999999999999999999997:0i:0;a:0:{}i:2;i:0;i:0;R:2;';
var_dump(unserialize($s));
?>
--EXPECTF--
Notice: unserialize(): Error at offset 48 of 74 bytes in %s on line %d
bool(false)
10 changes: 10 additions & 0 deletions ext/standard/tests/serialize/bug74614.phpt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
--TEST--
Bug #74614: Use-after-free in PHP7's unserialize()
--FILE--
<?php

unserialize('a:3020000000000000000000000000000001:{i:0;a:0:{}i:1;i:2;i:2;i:3;i:3;i:4;i:4;i:5;i:5;i:6;i:6;i:7;i:7;i:8;i:8;R:2;}');

?>
--EXPECTF--
Notice: unserialize(): Error at offset 38 of 113 bytes in %s on line %d
68 changes: 36 additions & 32 deletions ext/standard/var_unserializer.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -503,6 +503,10 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, zend_long elements)
&& zend_hash_str_exists(&Z_OBJCE_P(rval)->function_table, "__wakeup", sizeof("__wakeup")-1);

ht = Z_OBJPROP_P(rval);
if (elements >= HT_MAX_SIZE - zend_hash_num_elements(ht)) {
return 0;
}

zend_hash_extend(ht, zend_hash_num_elements(ht) + elements, (ht->u.flags & HASH_FLAG_PACKED));
if (!process_nested_data(UNSERIALIZE_PASSTHRU, ht, elements, 1)) {
if (has_wakeup) {
Expand Down Expand Up @@ -578,7 +582,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
start = cursor;


#line 582 "ext/standard/var_unserializer.c"
#line 586 "ext/standard/var_unserializer.c"
{
YYCTYPE yych;
static const unsigned char yybm[] = {
Expand Down Expand Up @@ -636,9 +640,9 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
yy2:
++YYCURSOR;
yy3:
#line 959 "ext/standard/var_unserializer.re"
#line 963 "ext/standard/var_unserializer.re"
{ return 0; }
#line 642 "ext/standard/var_unserializer.c"
#line 646 "ext/standard/var_unserializer.c"
yy4:
yych = *(YYMARKER = ++YYCURSOR);
if (yych == ':') goto yy17;
Expand Down Expand Up @@ -685,13 +689,13 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
goto yy3;
yy15:
++YYCURSOR;
#line 953 "ext/standard/var_unserializer.re"
#line 957 "ext/standard/var_unserializer.re"
{
/* this is the case where we have less data than planned */
php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
return 0; /* not sure if it should be 0 or 1 here? */
}
#line 695 "ext/standard/var_unserializer.c"
#line 699 "ext/standard/var_unserializer.c"
yy17:
yych = *++YYCURSOR;
if (yybm[0+yych] & 128) {
Expand All @@ -703,13 +707,13 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
goto yy3;
yy19:
++YYCURSOR;
#line 637 "ext/standard/var_unserializer.re"
#line 641 "ext/standard/var_unserializer.re"
{
*p = YYCURSOR;
ZVAL_NULL(rval);
return 1;
}
#line 713 "ext/standard/var_unserializer.c"
#line 717 "ext/standard/var_unserializer.c"
yy21:
yych = *++YYCURSOR;
if (yych <= ',') {
Expand Down Expand Up @@ -959,7 +963,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
goto yy18;
yy63:
++YYCURSOR;
#line 586 "ext/standard/var_unserializer.re"
#line 590 "ext/standard/var_unserializer.re"
{
zend_long id;

Expand All @@ -985,7 +989,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)

return 1;
}
#line 989 "ext/standard/var_unserializer.c"
#line 993 "ext/standard/var_unserializer.c"
yy65:
yych = *++YYCURSOR;
if (yych == '"') goto yy84;
Expand All @@ -996,13 +1000,13 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
goto yy18;
yy67:
++YYCURSOR;
#line 643 "ext/standard/var_unserializer.re"
#line 647 "ext/standard/var_unserializer.re"
{
*p = YYCURSOR;
ZVAL_BOOL(rval, parse_iv(start + 2));
return 1;
}
#line 1006 "ext/standard/var_unserializer.c"
#line 1010 "ext/standard/var_unserializer.c"
yy69:
++YYCURSOR;
if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
Expand All @@ -1022,7 +1026,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
}
yy71:
++YYCURSOR;
#line 691 "ext/standard/var_unserializer.re"
#line 695 "ext/standard/var_unserializer.re"
{
#if SIZEOF_ZEND_LONG == 4
use_double:
Expand All @@ -1031,7 +1035,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
return 1;
}
#line 1035 "ext/standard/var_unserializer.c"
#line 1039 "ext/standard/var_unserializer.c"
yy73:
yych = *++YYCURSOR;
if (yych <= ',') {
Expand All @@ -1053,7 +1057,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
goto yy18;
yy76:
++YYCURSOR;
#line 649 "ext/standard/var_unserializer.re"
#line 653 "ext/standard/var_unserializer.re"
{
#if SIZEOF_ZEND_LONG == 4
int digits = YYCURSOR - start - 3;
Expand All @@ -1079,14 +1083,14 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
ZVAL_LONG(rval, parse_iv(start + 2));
return 1;
}
#line 1083 "ext/standard/var_unserializer.c"
#line 1087 "ext/standard/var_unserializer.c"
yy78:
yych = *++YYCURSOR;
if (yych == '"') goto yy92;
goto yy18;
yy79:
++YYCURSOR;
#line 612 "ext/standard/var_unserializer.re"
#line 616 "ext/standard/var_unserializer.re"
{
zend_long id;

Expand All @@ -1111,14 +1115,14 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)

return 1;
}
#line 1115 "ext/standard/var_unserializer.c"
#line 1119 "ext/standard/var_unserializer.c"
yy81:
yych = *++YYCURSOR;
if (yych == '"') goto yy94;
goto yy18;
yy82:
++YYCURSOR;
#line 801 "ext/standard/var_unserializer.re"
#line 805 "ext/standard/var_unserializer.re"
{
size_t len, len2, len3, maxlen;
zend_long elements;
Expand Down Expand Up @@ -1270,10 +1274,10 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)

return object_common2(UNSERIALIZE_PASSTHRU, elements);
}
#line 1274 "ext/standard/var_unserializer.c"
#line 1278 "ext/standard/var_unserializer.c"
yy84:
++YYCURSOR;
#line 732 "ext/standard/var_unserializer.re"
#line 736 "ext/standard/var_unserializer.re"
{
size_t len, maxlen;
zend_string *str;
Expand Down Expand Up @@ -1307,17 +1311,17 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
ZVAL_STR(rval, str);
return 1;
}
#line 1311 "ext/standard/var_unserializer.c"
#line 1315 "ext/standard/var_unserializer.c"
yy86:
++YYCURSOR;
#line 766 "ext/standard/var_unserializer.re"
#line 770 "ext/standard/var_unserializer.re"
{
zend_long elements = parse_iv(start + 2);
/* use iv() not uiv() in order to check data range */
*p = YYCURSOR;
if (!var_hash) return 0;

if (elements < 0) {
if (elements < 0 || elements >= HT_MAX_SIZE) {
return 0;
}

Expand All @@ -1334,7 +1338,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)

return finish_nested_data(UNSERIALIZE_PASSTHRU);
}
#line 1338 "ext/standard/var_unserializer.c"
#line 1342 "ext/standard/var_unserializer.c"
yy88:
yych = *++YYCURSOR;
if (yych <= ',') {
Expand All @@ -1359,21 +1363,21 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
goto yy18;
yy92:
++YYCURSOR;
#line 790 "ext/standard/var_unserializer.re"
#line 794 "ext/standard/var_unserializer.re"
{
long elements;
if (!var_hash) return 0;

elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
if (elements < 0) {
if (elements < 0 || elements >= HT_MAX_SIZE) {
return 0;
}
return object_common2(UNSERIALIZE_PASSTHRU, elements);
}
#line 1374 "ext/standard/var_unserializer.c"
#line 1378 "ext/standard/var_unserializer.c"
yy94:
++YYCURSOR;
#line 700 "ext/standard/var_unserializer.re"
#line 704 "ext/standard/var_unserializer.re"
{
size_t len, maxlen;
char *str;
Expand Down Expand Up @@ -1405,15 +1409,15 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
ZVAL_STRINGL(rval, str, len);
return 1;
}
#line 1409 "ext/standard/var_unserializer.c"
#line 1413 "ext/standard/var_unserializer.c"
yy96:
yych = *++YYCURSOR;
if (yych <= '/') goto yy18;
if (yych <= '9') goto yy89;
goto yy18;
yy97:
++YYCURSOR;
#line 675 "ext/standard/var_unserializer.re"
#line 679 "ext/standard/var_unserializer.re"
{
*p = YYCURSOR;

Expand All @@ -1429,9 +1433,9 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)

return 1;
}
#line 1433 "ext/standard/var_unserializer.c"
#line 1437 "ext/standard/var_unserializer.c"
}
#line 961 "ext/standard/var_unserializer.re"
#line 965 "ext/standard/var_unserializer.re"


return 0;
Expand Down
8 changes: 6 additions & 2 deletions ext/standard/var_unserializer.re
View file
Original file line number Diff line number Diff line change
Expand Up @@ -507,6 +507,10 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, zend_long elements)
&& zend_hash_str_exists(&Z_OBJCE_P(rval)->function_table, "__wakeup", sizeof("__wakeup")-1);

ht = Z_OBJPROP_P(rval);
if (elements >= HT_MAX_SIZE - zend_hash_num_elements(ht)) {
return 0;
}

zend_hash_extend(ht, zend_hash_num_elements(ht) + elements, (ht->u.flags & HASH_FLAG_PACKED));
if (!process_nested_data(UNSERIALIZE_PASSTHRU, ht, elements, 1)) {
if (has_wakeup) {
Expand Down Expand Up @@ -769,7 +773,7 @@ use_double:
*p = YYCURSOR;
if (!var_hash) return 0;
if (elements < 0) {
if (elements < 0 || elements >= HT_MAX_SIZE) {
return 0;
}
Expand All @@ -792,7 +796,7 @@ use_double:
if (!var_hash) return 0;

elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
if (elements < 0) {
if (elements < 0 || elements >= HT_MAX_SIZE) {
return 0;
}
return object_common2(UNSERIALIZE_PASSTHRU, elements);
Expand Down

0 comments on commit d02f953

Please sign in to comment.