Browse Source
Merge branch 'PHP-5.6'
Merge branch 'PHP-5.6'
* PHP-5.6: update NEWS fix test update NEWS Fix bug #70019 - limit extracted files to given directory Do not do convert_to_* on unserialize, it messes up references Fix #69793 - limit what we accept when unserializing exception Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList) Fixed bug #70166 - Use After Free Vulnerability in unserialize() with SPLArrayObject ignore signatures for packages too Fix bug #70168 - Use After Free Vulnerability in unserialize() with SplObjectStorage Fixed bug #69892 Fix bug #70014 - use RAND_bytes instead of deprecated RAND_pseudo_bytes Improved fix for Bug #69441 Fix bug #70068 (Dangling pointer in the unserialization of ArrayObject items) Fix bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref) Fix bug #70081: check types for SOAP variables Conflicts: Zend/zend_exceptions.c ext/date/php_date.c ext/openssl/openssl.c ext/phar/phar_internal.h ext/soap/php_http.c ext/spl/spl_array.c ext/spl/spl_dllist.c ext/spl/spl_observer.c ext/standard/tests/serialize/bug69152.phpt sapi/cli/tests/005.phptpull/1458/head
Stanislav Malyshev
10 years ago
20 changed files with 274 additions and 36 deletions
-
3.gitignore
-
9Zend/tests/bug70121.phpt
-
35Zend/zend_exceptions.c
-
12ext/date/tests/bug53437_var3.phpt
-
12ext/date/tests/bug53437_var5.phpt
-
6ext/openssl/openssl.c
-
15ext/phar/phar_internal.h
-
50ext/phar/phar_object.c
-
22ext/phar/tests/bug70019.phpt
-
BINext/phar/tests/bug70019.zip
-
7ext/soap/php_http.c
-
6ext/spl/spl_array.c
-
2ext/spl/spl_observer.c
-
9ext/spl/tests/bug70068.phpt
-
29ext/spl/tests/bug70166.phpt
-
36ext/spl/tests/bug70168.phpt
-
30ext/spl/tests/bug70169.phpt
-
1ext/standard/tests/serialize/bug69152.phpt
-
17ext/standard/tests/serialize/bug69793.phpt
-
9sapi/cli/tests/005.phpt
@ -0,0 +1,9 @@ |
|||
--TEST-- |
|||
Bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref) |
|||
--FILE-- |
|||
<?php |
|||
unserialize('O:12:"DateInterval":1:{s:4:"days";O:9:"Exception":7:{s:10:"'."\0".'*'."\0".'message";s:1:"x";s:17:"'."\0".'Exception'."\0".'string";s:1:"A";s:7:"'."\0".'*'."\0".'code";i:0;s:7:"'."\0".'*'."\0".'file";s:1:"a";s:7:"'."\0".'*'."\0".'line";i:1337;s:16:"'."\0".'Exception'."\0".'trace";a:0:{}s:19:"'."\0".'Exception'."\0".'previous";O:8:"stdClass":0:{}}}'); |
|||
?> |
|||
OK |
|||
--EXPECT-- |
|||
OK |
|||
@ -0,0 +1,22 @@ |
|||
--TEST-- |
|||
Bug #70019 Files extracted from archive may be placed outside of destination directory |
|||
--FILE-- |
|||
<?php |
|||
$dir = __DIR__."/bug70019"; |
|||
$phar = new PharData(__DIR__."/bug70019.zip"); |
|||
if(!is_dir($dir)) { |
|||
mkdir($dir); |
|||
} |
|||
$phar->extractTo($dir); |
|||
var_dump(file_exists("$dir/ThisIsATestFile.txt")); |
|||
?> |
|||
===DONE=== |
|||
--CLEAN-- |
|||
<?php |
|||
$dir = __DIR__."/bug70019"; |
|||
unlink("$dir/ThisIsATestFile.txt"); |
|||
rmdir($dir); |
|||
?> |
|||
--EXPECTF-- |
|||
bool(true) |
|||
===DONE=== |
|||
@ -0,0 +1,9 @@ |
|||
--TEST-- |
|||
Bug #70068 (Dangling pointer in the unserialization of ArrayObject items) |
|||
--FILE-- |
|||
<?php |
|||
$a = unserialize('a:3:{i:0;C:11:"ArrayObject":20:{x:i:0;r:3;;m:a:0:{};}i:1;d:11;i:2;S:31:"AAAAAAAABBBBCCCC\01\00\00\00\04\00\00\00\00\00\00\00\00\00\00";}'); |
|||
?> |
|||
OK |
|||
--EXPECT-- |
|||
OK |
|||
@ -0,0 +1,29 @@ |
|||
--TEST-- |
|||
SPL: Bug #70166 Use After Free Vulnerability in unserialize() with SPLArrayObject |
|||
--FILE-- |
|||
<?php |
|||
$inner = 'x:i:1;a:0:{};m:a:0:{}'; |
|||
$exploit = 'a:2:{i:0;C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}i:1;R:5;}'; |
|||
|
|||
$data = unserialize($exploit); |
|||
|
|||
for($i = 0; $i < 5; $i++) { |
|||
$v[$i] = 'hi'.$i; |
|||
} |
|||
|
|||
var_dump($data); |
|||
?> |
|||
===DONE=== |
|||
--EXPECTF-- |
|||
array(2) { |
|||
[0]=> |
|||
object(ArrayObject)#%d (1) { |
|||
["storage":"ArrayObject":private]=> |
|||
array(0) { |
|||
} |
|||
} |
|||
[1]=> |
|||
array(0) { |
|||
} |
|||
} |
|||
===DONE=== |
|||
@ -0,0 +1,36 @@ |
|||
--TEST-- |
|||
SPL: Bug #70168 Use After Free Vulnerability in unserialize() with SplObjectStorage |
|||
--FILE-- |
|||
<?php |
|||
$inner = 'x:i:1;O:8:"stdClass":0:{};m:a:0:{}'; |
|||
$exploit = 'a:2:{i:0;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:1;R:3;}'; |
|||
|
|||
$data = unserialize($exploit); |
|||
|
|||
for($i = 0; $i < 5; $i++) { |
|||
$v[$i] = 'hi'.$i; |
|||
} |
|||
|
|||
var_dump($data); |
|||
?> |
|||
===DONE=== |
|||
--EXPECTF-- |
|||
array(2) { |
|||
[0]=> |
|||
object(SplObjectStorage)#%d (1) { |
|||
["storage":"SplObjectStorage":private]=> |
|||
array(1) { |
|||
["%s"]=> |
|||
array(2) { |
|||
["obj"]=> |
|||
object(stdClass)#2 (0) { |
|||
} |
|||
["inf"]=> |
|||
NULL |
|||
} |
|||
} |
|||
} |
|||
[1]=> |
|||
int(1) |
|||
} |
|||
===DONE=== |
|||
@ -0,0 +1,30 @@ |
|||
--TEST-- |
|||
SPL: Bug #70169 Use After Free Vulnerability in unserialize() with SplDoublyLinkedList |
|||
--FILE-- |
|||
<?php |
|||
$inner = 'i:1;'; |
|||
$exploit = 'a:2:{i:0;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:1;R:3;}'; |
|||
|
|||
$data = unserialize($exploit); |
|||
|
|||
for($i = 0; $i < 5; $i++) { |
|||
$v[$i] = 'hi'.$i; |
|||
} |
|||
|
|||
var_dump($data); |
|||
?> |
|||
===DONE=== |
|||
--EXPECTF-- |
|||
array(2) { |
|||
[0]=> |
|||
object(SplDoublyLinkedList)#%d (2) { |
|||
["flags":"SplDoublyLinkedList":private]=> |
|||
int(1) |
|||
["dllist":"SplDoublyLinkedList":private]=> |
|||
array(0) { |
|||
} |
|||
} |
|||
[1]=> |
|||
int(1) |
|||
} |
|||
===DONE=== |
|||
@ -0,0 +1,17 @@ |
|||
--TEST-- |
|||
Bug #69793: Remotely triggerable stack exhaustion via recursive method calls |
|||
--FILE-- |
|||
<?php |
|||
$e = unserialize('O:9:"Exception":7:{s:17:"'."\0".'Exception'."\0".'string";s:1:"a";s:7:"'."\0".'*'."\0".'code";i:0;s:7:"'."\0".'*'."\0".'file";R:1;s:7:"'."\0".'*'."\0".'line";i:1337;s:16:"'."\0".'Exception'."\0".'trace";a:0:{}s:19:"'."\0".'Exception'."\0".'previous";i:10;s:10:"'."\0".'*'."\0".'message";N;}'); |
|||
|
|||
var_dump($e.""); |
|||
?> |
|||
--EXPECTF-- |
|||
Notice: Undefined property: Exception::$message in %s/bug69793.php on line %d |
|||
|
|||
Notice: Undefined property: Exception::$file in %s/bug69793.php on line %d |
|||
|
|||
Notice: Undefined property: Exception::$previous in %s/bug69793.php on line %d |
|||
string(53) "exception 'Exception' in :1337 |
|||
Stack trace: |
|||
#0 {main}" |
|||
Write
Preview
Loading…
Cancel
Save
Reference in new issue