From: Stanislav Malyshev <stas@php.net>
Date: Tue, 11 Oct 2016 05:54:29 +0000 (-0700)
Subject: Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object... 
X-Git-Tag: php-7.1.0RC4~61
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f901dce57548cf1ef63578966ee16fa11509adcf;p=php

Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key

(cherry picked from commit 61cdd1255d5b9c8453be71aacbbf682796ac77d4)
---

diff --git a/ext/spl/spl_observer.c b/ext/spl/spl_observer.c
index 4ad0c6d15e..b94ab401cf 100644
--- a/ext/spl/spl_observer.c
+++ b/ext/spl/spl_observer.c
@@ -788,6 +788,9 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	--p; /* for ';' */
 	count = Z_LVAL_P(pcount);
 
+	ZVAL_UNDEF(&entry);
+	ZVAL_UNDEF(&inf);
+
 	while (count-- > 0) {
 		spl_SplObjectStorageElement *pelement;
 		zend_hash_key key;
@@ -803,18 +806,17 @@ SPL_METHOD(SplObjectStorage, unserialize)
 		if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) {
 			goto outexcept;
 		}
-		if (Z_TYPE(entry) != IS_OBJECT) {
-			zval_ptr_dtor(&entry);
-			goto outexcept;
-		}
 		if (*p == ',') { /* new version has inf */
 			++p;
 			if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) {
 				zval_ptr_dtor(&entry);
 				goto outexcept;
 			}
-		} else {
-			ZVAL_UNDEF(&inf);
+		}
+		if (Z_TYPE(entry) != IS_OBJECT) {
+			zval_ptr_dtor(&entry);
+			zval_ptr_dtor(&inf);
+			goto outexcept;
 		}
 
 		if (spl_object_storage_get_hash(&key, intern, getThis(), &entry) == FAILURE) {