Skip to content

Commit 3b29f51

Browse files
committed
Revert "Remove class validation. zend_lookup_class_ex() performs it anyway."
This reverts commit 61cf135. Class name validation is only performed if key is not passed. Here, lc_name is passed as key.
1 parent 61cf135 commit 3b29f51

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

ext/standard/var_unserializer.re

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1171,6 +1171,12 @@ object ":" uiv ":" ["] {
11711171
break;
11721172
}
11731173

1174+
if (!zend_is_valid_class_name(class_name)) {
1175+
zend_string_release_ex(lc_name, 0);
1176+
zend_string_release_ex(class_name, 0);
1177+
return 0;
1178+
}
1179+
11741180
/* Try to find class directly */
11751181
BG(serialize_lock)++;
11761182
ce = zend_lookup_class_ex(class_name, lc_name, 0);

0 commit comments

Comments
 (0)