Skip to content

Commit ecb7f58

Browse files
committed
Fix bug #73029 - Missing type check when unserializing SplArray
1 parent b88393f commit ecb7f58

File tree

2 files changed

+20
-2
lines changed

2 files changed

+20
-2
lines changed

Diff for: ext/spl/spl_array.c

+4-2
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
308308
long index;
309309
HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
310310

311-
if (!offset) {
311+
if (!offset || !ht) {
312312
return &EG(uninitialized_zval_ptr);
313313
}
314314

@@ -1810,7 +1810,9 @@ SPL_METHOD(Array, unserialize)
18101810
intern->ar_flags |= flags & SPL_ARRAY_CLONE_MASK;
18111811
zval_ptr_dtor(&intern->array);
18121812
ALLOC_INIT_ZVAL(intern->array);
1813-
if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)) {
1813+
if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)
1814+
|| (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) {
1815+
zval_ptr_dtor(&intern->array);
18141816
goto outexcept;
18151817
}
18161818
var_push_dtor(&var_hash, &intern->array);

Diff for: ext/spl/tests/bug73029.phpt

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
--TEST--
2+
Bug #73029: Missing type check when unserializing SplArray
3+
--FILE--
4+
<?php
5+
try {
6+
$a = 'C:11:"ArrayObject":19:0x:i:0;r:2;;m:a:0:{}}';
7+
$m = unserialize($a);
8+
$x = $m[2];
9+
} catch(UnexpectedValueException $e) {
10+
print $e->getMessage() . "\n";
11+
}
12+
?>
13+
DONE
14+
--EXPECTF--
15+
Error at offset 10 of 19 bytes
16+
DONE

0 commit comments

Comments
 (0)