]> granicus.if.org Git - php/commitdiff
Fix bug #73052 - Memory Corruption in During Deserialized-object Destruction
authorStanislav Malyshev <stas@php.net>
Mon, 12 Sep 2016 04:19:29 +0000 (21:19 -0700)
committerAnatol Belski <ab@php.net>
Mon, 12 Sep 2016 15:53:44 +0000 (17:53 +0200)
(cherry picked from commit b6e1e5e0b3e6221c7b14fa10cba30f5c5e719e1b)

Conflicts:
Zend/zend_objects_API.c
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re

ext/standard/tests/serialize/bug73052.phpt [new file with mode: 0644]

diff --git a/ext/standard/tests/serialize/bug73052.phpt b/ext/standard/tests/serialize/bug73052.phpt
new file mode 100644 (file)
index 0000000..63b484b
--- /dev/null
@@ -0,0 +1,18 @@
+--TEST--
+Bug #73052: Memory Corruption in During Deserialized-object Destruction
+--FILE--
+<?php
+
+class obj {
+    var $ryat;
+    public function __destruct() {
+        $this->ryat = null;
+    }
+}
+
+$poc = 'O:3:"obj":1:{';
+var_dump(unserialize($poc));
+?>
+--EXPECTF--
+Notice: unserialize(): Error at offset 13 of 13 bytes in %sbug73052.php on line %d
+bool(false)