Skip to content

Commit 878b8f0

Browse files
nikicnikic
committed
Merge branch 'PHP-7.0' into PHP-7.1
2 parents 2a34042 + 9f560ba commit 878b8f0

File tree

4 files changed

+47
-11
lines changed

4 files changed

+47
-11
lines changed

‎NEWS

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,10 @@ PHP NEWS
5353
set). (cmb)
5454

5555
- Standard:
56-
. Fixed bug #73594 (dns_get_record does not populate $additional out parameter).
57-
(Bruce Weirdan)
56+
. Fixed bug #73594 (dns_get_record does not populate $additional out
57+
parameter). (Bruce Weirdan)
58+
. Fixed bug #70213 (Unserialize context shared on double class lookup).
59+
(Taoguang Chen)
5860

5961
- Zlib
6062
. Fixed bug #73373 (deflate_add does not verify that output was not truncated).

‎ext/standard/tests/serialize/bug70213.phpt

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
--TEST--
2+
Bug #70213: Unserialize context shared on double class lookup
3+
--FILE--
4+
<?php
5+
6+
ini_set('unserialize_callback_func', 'evil');
7+
8+
function evil() {
9+
function __autoload($arg) {
10+
var_dump(unserialize('R:1;'));
11+
}
12+
}
13+
14+
var_dump(unserialize('a:2:{i:0;i:42;i:1;O:4:"evil":0:{}}'));
15+
16+
?>
17+
--EXPECTF--
18+
Notice: unserialize(): Error at offset 4 of 4 bytes in %s on line %d
19+
bool(false)
20+
21+
Warning: unserialize(): Function evil() hasn't defined the class it was called for in %s on line %d
22+
array(2) {
23+
[0]=>
24+
int(42)
25+
[1]=>
26+
object(__PHP_Incomplete_Class)#1 (1) {
27+
["__PHP_Incomplete_Class_Name"]=>
28+
string(4) "evil"
29+
}
30+
}

‎ext/standard/var_unserializer.c

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -647,7 +647,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
647647
yy2:
648648
++YYCURSOR;
649649
yy3:
650-
#line 959 "ext/standard/var_unserializer.re"
650+
#line 961 "ext/standard/var_unserializer.re"
651651
{ return 0; }
652652
#line 653 "ext/standard/var_unserializer.c"
653653
yy4:
@@ -696,7 +696,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
696696
goto yy3;
697697
yy15:
698698
++YYCURSOR;
699-
#line 953 "ext/standard/var_unserializer.re"
699+
#line 955 "ext/standard/var_unserializer.re"
700700
{
701701
/* this is the case where we have less data than planned */
702702
php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
@@ -1240,11 +1240,13 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
12401240
}
12411241

12421242
/* The callback function may have defined the class */
1243+
BG(serialize_lock)++;
12431244
if ((ce = zend_lookup_class(class_name)) == NULL) {
12441245
php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func));
12451246
incomplete_class = 1;
12461247
ce = PHP_IC_ENTRY;
12471248
}
1249+
BG(serialize_lock)--;
12481250

12491251
zval_ptr_dtor(&user_func);
12501252
zval_ptr_dtor(&args[0]);
@@ -1274,7 +1276,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
12741276

12751277
return object_common2(UNSERIALIZE_PASSTHRU, elements);
12761278
}
1277-
#line 1278 "ext/standard/var_unserializer.c"
1279+
#line 1280 "ext/standard/var_unserializer.c"
12781280
yy84:
12791281
++YYCURSOR;
12801282
#line 743 "ext/standard/var_unserializer.re"
@@ -1311,7 +1313,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
13111313
ZVAL_STR(rval, str);
13121314
return 1;
13131315
}
1314-
#line 1315 "ext/standard/var_unserializer.c"
1316+
#line 1317 "ext/standard/var_unserializer.c"
13151317
yy86:
13161318
++YYCURSOR;
13171319
#line 777 "ext/standard/var_unserializer.re"
@@ -1338,7 +1340,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
13381340

13391341
return finish_nested_data(UNSERIALIZE_PASSTHRU);
13401342
}
1341-
#line 1342 "ext/standard/var_unserializer.c"
1343+
#line 1344 "ext/standard/var_unserializer.c"
13421344
yy88:
13431345
yych = *++YYCURSOR;
13441346
if (yych <= ',') {
@@ -1370,7 +1372,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
13701372
return object_common2(UNSERIALIZE_PASSTHRU,
13711373
object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
13721374
}
1373-
#line 1374 "ext/standard/var_unserializer.c"
1375+
#line 1376 "ext/standard/var_unserializer.c"
13741376
yy94:
13751377
++YYCURSOR;
13761378
#line 711 "ext/standard/var_unserializer.re"
@@ -1405,7 +1407,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
14051407
ZVAL_STRINGL(rval, str, len);
14061408
return 1;
14071409
}
1408-
#line 1409 "ext/standard/var_unserializer.c"
1410+
#line 1411 "ext/standard/var_unserializer.c"
14091411
yy96:
14101412
yych = *++YYCURSOR;
14111413
if (yych <= '/') goto yy18;
@@ -1429,9 +1431,9 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
14291431

14301432
return 1;
14311433
}
1432-
#line 1433 "ext/standard/var_unserializer.c"
1434+
#line 1435 "ext/standard/var_unserializer.c"
14331435
}
1434-
#line 961 "ext/standard/var_unserializer.re"
1436+
#line 963 "ext/standard/var_unserializer.re"
14351437

14361438

14371439
return 0;

‎ext/standard/var_unserializer.re

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -915,11 +915,13 @@ object ":" uiv ":" ["] {
915915
}
916916

917917
/* The callback function may have defined the class */
918+
BG(serialize_lock)++;
918919
if ((ce = zend_lookup_class(class_name)) == NULL) {
919920
php_error_docref(NULL, E_WARNING, "Function %s() hasn't defined the class it was called for", Z_STRVAL(user_func));
920921
incomplete_class = 1;
921922
ce = PHP_IC_ENTRY;
922923
}
924+
BG(serialize_lock)--;
923925

924926
zval_ptr_dtor(&user_func);
925927
zval_ptr_dtor(&args[0]);

0 commit comments

Comments
 (0)