Skip to content

Commit 8f60309

Browse files
committed
Fix GH-16589: UAF in SplDoublyLinked->serialize()
Closes GH-16611.
1 parent 992ac1c commit 8f60309

File tree

3 files changed

+32
-1
lines changed

3 files changed

+32
-1
lines changed

NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ PHP NEWS
105105
. Fixed bug GH-16588 (UAF in Observer->serialize). (nielsdos)
106106
. Fix GH-16477 (Segmentation fault when calling __debugInfo() after failed
107107
SplFileObject::__constructor). (Girgias)
108+
. Fixed bug GH-16589 (UAF in SplDoublyLinked->serialize()). (nielsdos)
108109

109110
- Standard:
110111
. Fixed bug GH-16293 (Failed assertion when throwing in assert() callback with

ext/spl/spl_dllist.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,13 @@ PHPAPI zend_class_entry *spl_ce_SplStack;
4444
efree(elem); \
4545
}
4646

47-
#define SPL_LLIST_CHECK_DELREF(elem) if ((elem) && !--SPL_LLIST_RC(elem)) { \
47+
#define SPL_LLIST_CHECK_DELREF_EX(elem, on_free) if ((elem) && !--SPL_LLIST_RC(elem)) { \
4848
efree(elem); \
49+
on_free \
4950
}
5051

52+
#define SPL_LLIST_CHECK_DELREF(elem) SPL_LLIST_CHECK_DELREF_EX(elem, ;)
53+
5154
#define SPL_LLIST_ADDREF(elem) SPL_LLIST_RC(elem)++
5255
#define SPL_LLIST_CHECK_ADDREF(elem) if (elem) SPL_LLIST_RC(elem)++
5356

@@ -1024,8 +1027,12 @@ PHP_METHOD(SplDoublyLinkedList, serialize)
10241027
smart_str_appendc(&buf, ':');
10251028
next = current->next;
10261029

1030+
SPL_LLIST_CHECK_ADDREF(next);
1031+
10271032
php_var_serialize(&buf, &current->data, &var_hash);
10281033

1034+
SPL_LLIST_CHECK_DELREF_EX(next, break;);
1035+
10291036
current = next;
10301037
}
10311038

ext/spl/tests/gh16589.phpt

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
--TEST--
2+
GH-16589 (UAF in SplDoublyLinked->serialize())
3+
--CREDITS--
4+
chibinz
5+
--FILE--
6+
<?php
7+
8+
class C {
9+
function __serialize(): array {
10+
global $list;
11+
$list->pop();
12+
return [];
13+
}
14+
}
15+
16+
$list = new SplDoublyLinkedList;
17+
$list->add(0, new C);
18+
$list->add(1, 1);
19+
var_dump($list->serialize());
20+
21+
?>
22+
--EXPECT--
23+
string(17) "i:0;:O:1:"C":0:{}"

0 commit comments

Comments
 (0)