Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting)

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index bf034ab248a1a8acf4057ba4a9f1534cd878ba1c..ec9ce217d3898d7063938f7349b41f364d8de3be 100644 (file)
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -1745,6 +1745,7 @@ SPL_METHOD(Array, unserialize)
        const unsigned char *p, *s;
        php_unserialize_data_t var_hash;
        zval *pmembers, *pflags = NULL;
+       HashTable *aht;
        long flags;
        
        if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) {
@@ -1756,6 +1757,12 @@ SPL_METHOD(Array, unserialize)
                return;
        }
 
+       aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
+       if (aht->nApplyCount > 0) {
+               zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
+               return;
+       }
+
        /* storage */
        s = p = (const unsigned char*)buf;
        PHP_VAR_UNSERIALIZE_INIT(var_hash);

diff --git a/ext/spl/tests/bug67539.phpt b/ext/spl/tests/bug67539.phpt
new file mode 100644 (file)
index 0000000..8bab2a8
--- /dev/null
+++ b/ext/spl/tests/bug67539.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #67539 (ArrayIterator use-after-free due to object change during sorting)
+--FILE--
+<?php
+
+$it = new ArrayIterator(array_fill(0,2,'X'), 1 );
+
+function badsort($a, $b) {
+        $GLOBALS['it']->unserialize($GLOBALS['it']->serialize());
+        return TRUE;
+}
+
+$it->uksort('badsort');
+--EXPECTF--
+Warning: Modification of ArrayObject during sorting is prohibited in %sbug67539.php on line %d