Fix #77177: Serializing or unserializing COM objects crashes #3672
Conversation
Firstly, we avoid returning NULL from the get_property handler, but instead return an empty HashTable, which already prevents the crashes. Secondly, since (de-)serialization obviously makes no sense for COM, DOTNET and VARIANT objects (at least with the current implementation), we prohibit it right away.
|
Note to eventual merger: as of PHP-7.3 |
|
I think the patch looks good. Side note; ext/com_dotnet has barely been updated with many changes to newer internal APIs, sometimes I worry that it only just compiles. It wasn't until a few years ago that Reflection also kept crashing on COM instances[1]. All in all, I think it perhaps is worth taking a look at the extension as a whole, as I doubt this is the only similar issue. |
|
@CMB i've tested and everything seems ok. Please merge it when have time. Not sure we can get it into 7.1, perhaps at RMs convenience. Thanks. |
Well, com_dotnet is listed as maintained, so everything should be fine, ;) @weltling My Github nick is @cmb69 – guess Chris Brannon is not too happy to get unrelated mentions. :)
Since php-7.1.25RC1 has been tagged in the meantime, I think we should only target PHP-7.2+. @sgolemon? |
|
Applied to PHP-7.2 and merged up. |
No need to define our own `com_dotnet_object_properties` as empty hash, since we can use `zend_empty_array` instead as of PHP 7.3.0. Cf. <#3672 (comment)>.
Firstly, we avoid returning NULL from the get_property handler, but
instead return an empty HashTable, which already prevents the crashes.
Secondly, since (de-)serialization obviously makes no sense for COM,
DOTNET and VARIANT objects (at least with the current implementation),
we prohibit it right away.