Skip to content

Commit 672a396

Browse files
laruencelaruence
committed
Merge branch 'PHP-5.5' into PHP-5.6
Conflicts: ext/standard/var_unserializer.c
2 parents aaaa905 + caebb76 commit 672a396

File tree

3 files changed

+44
-37
lines changed

3 files changed

+44
-37
lines changed

‎ext/standard/tests/serialize/bug69139.phpt

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
--TEST--
2+
Bug #69139 (Crash in gc_zval_possible_root on unserialize)
3+
--FILE--
4+
<?php
5+
$str = 'a:1126666:{i:0;r:1;i:-09610;r:1;i:-0;i:0;i:0;O:1:"A":2119X:i:0;i:0;i:0;i:0;i:0;O:1:"A":2116:{i:0;r:5;i:-096766610;r:1;i:-610;r:1;i:0;i:0;';
6+
@unserialize($str);
7+
echo "Alive";
8+
?>
9+
--EXPECT--
10+
Alive

‎ext/standard/var_unserializer.c

Lines changed: 33 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* Generated by re2c 0.13.7.5 */
1+
/* Generated by re2c 0.13.5 */
22
#line 1 "ext/standard/var_unserializer.re"
33
/*
44
+----------------------------------------------------------------------+
@@ -319,8 +319,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
319319
if (!php_var_unserialize(&data, p, max, var_hash TSRMLS_CC)) {
320320
zval_dtor(key);
321321
FREE_ZVAL(key);
322-
zval_dtor(data);
323-
FREE_ZVAL(data);
322+
zval_ptr_dtor(&data);
324323
return 0;
325324
}
326325

@@ -478,7 +477,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
478477

479478

480479

481-
#line 482 "ext/standard/var_unserializer.c"
480+
#line 481 "ext/standard/var_unserializer.c"
482481
{
483482
YYCTYPE yych;
484483
static const unsigned char yybm[] = {
@@ -538,9 +537,9 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
538537
yych = *(YYMARKER = ++YYCURSOR);
539538
if (yych == ':') goto yy95;
540539
yy3:
541-
#line 833 "ext/standard/var_unserializer.re"
540+
#line 832 "ext/standard/var_unserializer.re"
542541
{ return 0; }
543-
#line 544 "ext/standard/var_unserializer.c"
542+
#line 543 "ext/standard/var_unserializer.c"
544543
yy4:
545544
yych = *(YYMARKER = ++YYCURSOR);
546545
if (yych == ':') goto yy89;
@@ -583,13 +582,13 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
583582
goto yy3;
584583
yy14:
585584
++YYCURSOR;
586-
#line 827 "ext/standard/var_unserializer.re"
585+
#line 826 "ext/standard/var_unserializer.re"
587586
{
588587
/* this is the case where we have less data than planned */
589588
php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
590589
return 0; /* not sure if it should be 0 or 1 here? */
591590
}
592-
#line 593 "ext/standard/var_unserializer.c"
591+
#line 592 "ext/standard/var_unserializer.c"
593592
yy16:
594593
yych = *++YYCURSOR;
595594
goto yy3;
@@ -615,12 +614,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
615614
if (yybm[0+yych] & 128) {
616615
goto yy20;
617616
}
618-
if (yych <= '/') goto yy18;
619-
if (yych >= ';') goto yy18;
617+
if (yych != ':') goto yy18;
620618
yych = *++YYCURSOR;
621619
if (yych != '"') goto yy18;
622620
++YYCURSOR;
623-
#line 681 "ext/standard/var_unserializer.re"
621+
#line 680 "ext/standard/var_unserializer.re"
624622
{
625623
size_t len, len2, len3, maxlen;
626624
long elements;
@@ -766,7 +764,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
766764

767765
return object_common2(UNSERIALIZE_PASSTHRU, elements);
768766
}
769-
#line 770 "ext/standard/var_unserializer.c"
767+
#line 768 "ext/standard/var_unserializer.c"
770768
yy25:
771769
yych = *++YYCURSOR;
772770
if (yych <= ',') {
@@ -791,15 +789,15 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
791789
yych = *++YYCURSOR;
792790
if (yych != '"') goto yy18;
793791
++YYCURSOR;
794-
#line 673 "ext/standard/var_unserializer.re"
792+
#line 672 "ext/standard/var_unserializer.re"
795793
{
796794

797795
INIT_PZVAL(*rval);
798796

799797
return object_common2(UNSERIALIZE_PASSTHRU,
800798
object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
801799
}
802-
#line 803 "ext/standard/var_unserializer.c"
800+
#line 801 "ext/standard/var_unserializer.c"
803801
yy32:
804802
yych = *++YYCURSOR;
805803
if (yych == '+') goto yy33;
@@ -820,7 +818,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
820818
yych = *++YYCURSOR;
821819
if (yych != '{') goto yy18;
822820
++YYCURSOR;
823-
#line 653 "ext/standard/var_unserializer.re"
821+
#line 652 "ext/standard/var_unserializer.re"
824822
{
825823
long elements = parse_iv(start + 2);
826824
/* use iv() not uiv() in order to check data range */
@@ -840,7 +838,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
840838

841839
return finish_nested_data(UNSERIALIZE_PASSTHRU);
842840
}
843-
#line 844 "ext/standard/var_unserializer.c"
841+
#line 842 "ext/standard/var_unserializer.c"
844842
yy39:
845843
yych = *++YYCURSOR;
846844
if (yych == '+') goto yy40;
@@ -861,7 +859,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
861859
yych = *++YYCURSOR;
862860
if (yych != '"') goto yy18;
863861
++YYCURSOR;
864-
#line 624 "ext/standard/var_unserializer.re"
862+
#line 623 "ext/standard/var_unserializer.re"
865863
{
866864
size_t len, maxlen;
867865
char *str;
@@ -890,7 +888,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
890888
ZVAL_STRINGL(*rval, str, len, 0);
891889
return 1;
892890
}
893-
#line 894 "ext/standard/var_unserializer.c"
891+
#line 892 "ext/standard/var_unserializer.c"
894892
yy46:
895893
yych = *++YYCURSOR;
896894
if (yych == '+') goto yy47;
@@ -911,7 +909,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
911909
yych = *++YYCURSOR;
912910
if (yych != '"') goto yy18;
913911
++YYCURSOR;
914-
#line 596 "ext/standard/var_unserializer.re"
912+
#line 595 "ext/standard/var_unserializer.re"
915913
{
916914
size_t len, maxlen;
917915
char *str;
@@ -939,7 +937,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
939937
ZVAL_STRINGL(*rval, str, len, 1);
940938
return 1;
941939
}
942-
#line 943 "ext/standard/var_unserializer.c"
940+
#line 941 "ext/standard/var_unserializer.c"
943941
yy53:
944942
yych = *++YYCURSOR;
945943
if (yych <= '/') {
@@ -1027,7 +1025,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
10271025
}
10281026
yy63:
10291027
++YYCURSOR;
1030-
#line 586 "ext/standard/var_unserializer.re"
1028+
#line 585 "ext/standard/var_unserializer.re"
10311029
{
10321030
#if SIZEOF_LONG == 4
10331031
use_double:
@@ -1037,7 +1035,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
10371035
ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
10381036
return 1;
10391037
}
1040-
#line 1041 "ext/standard/var_unserializer.c"
1038+
#line 1039 "ext/standard/var_unserializer.c"
10411039
yy65:
10421040
yych = *++YYCURSOR;
10431041
if (yych <= ',') {
@@ -1096,7 +1094,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
10961094
yych = *++YYCURSOR;
10971095
if (yych != ';') goto yy18;
10981096
++YYCURSOR;
1099-
#line 571 "ext/standard/var_unserializer.re"
1097+
#line 570 "ext/standard/var_unserializer.re"
11001098
{
11011099
*p = YYCURSOR;
11021100
INIT_PZVAL(*rval);
@@ -1111,7 +1109,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
11111109

11121110
return 1;
11131111
}
1114-
#line 1115 "ext/standard/var_unserializer.c"
1112+
#line 1113 "ext/standard/var_unserializer.c"
11151113
yy76:
11161114
yych = *++YYCURSOR;
11171115
if (yych == 'N') goto yy73;
@@ -1138,7 +1136,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
11381136
if (yych <= '9') goto yy79;
11391137
if (yych != ';') goto yy18;
11401138
++YYCURSOR;
1141-
#line 544 "ext/standard/var_unserializer.re"
1139+
#line 543 "ext/standard/var_unserializer.re"
11421140
{
11431141
#if SIZEOF_LONG == 4
11441142
int digits = YYCURSOR - start - 3;
@@ -1165,32 +1163,32 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
11651163
ZVAL_LONG(*rval, parse_iv(start + 2));
11661164
return 1;
11671165
}
1168-
#line 1169 "ext/standard/var_unserializer.c"
1166+
#line 1167 "ext/standard/var_unserializer.c"
11691167
yy83:
11701168
yych = *++YYCURSOR;
11711169
if (yych <= '/') goto yy18;
11721170
if (yych >= '2') goto yy18;
11731171
yych = *++YYCURSOR;
11741172
if (yych != ';') goto yy18;
11751173
++YYCURSOR;
1176-
#line 537 "ext/standard/var_unserializer.re"
1174+
#line 536 "ext/standard/var_unserializer.re"
11771175
{
11781176
*p = YYCURSOR;
11791177
INIT_PZVAL(*rval);
11801178
ZVAL_BOOL(*rval, parse_iv(start + 2));
11811179
return 1;
11821180
}
1183-
#line 1184 "ext/standard/var_unserializer.c"
1181+
#line 1182 "ext/standard/var_unserializer.c"
11841182
yy87:
11851183
++YYCURSOR;
1186-
#line 530 "ext/standard/var_unserializer.re"
1184+
#line 529 "ext/standard/var_unserializer.re"
11871185
{
11881186
*p = YYCURSOR;
11891187
INIT_PZVAL(*rval);
11901188
ZVAL_NULL(*rval);
11911189
return 1;
11921190
}
1193-
#line 1194 "ext/standard/var_unserializer.c"
1191+
#line 1192 "ext/standard/var_unserializer.c"
11941192
yy89:
11951193
yych = *++YYCURSOR;
11961194
if (yych <= ',') {
@@ -1213,7 +1211,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
12131211
if (yych <= '9') goto yy91;
12141212
if (yych != ';') goto yy18;
12151213
++YYCURSOR;
1216-
#line 507 "ext/standard/var_unserializer.re"
1214+
#line 506 "ext/standard/var_unserializer.re"
12171215
{
12181216
long id;
12191217

@@ -1236,7 +1234,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
12361234

12371235
return 1;
12381236
}
1239-
#line 1240 "ext/standard/var_unserializer.c"
1237+
#line 1238 "ext/standard/var_unserializer.c"
12401238
yy95:
12411239
yych = *++YYCURSOR;
12421240
if (yych <= ',') {
@@ -1259,7 +1257,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
12591257
if (yych <= '9') goto yy97;
12601258
if (yych != ';') goto yy18;
12611259
++YYCURSOR;
1262-
#line 486 "ext/standard/var_unserializer.re"
1260+
#line 485 "ext/standard/var_unserializer.re"
12631261
{
12641262
long id;
12651263

@@ -1280,9 +1278,9 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
12801278

12811279
return 1;
12821280
}
1283-
#line 1284 "ext/standard/var_unserializer.c"
1281+
#line 1282 "ext/standard/var_unserializer.c"
12841282
}
1285-
#line 835 "ext/standard/var_unserializer.re"
1283+
#line 834 "ext/standard/var_unserializer.re"
12861284

12871285

12881286
return 0;

‎ext/standard/var_unserializer.re

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -323,8 +323,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
323323
if (!php_var_unserialize(&data, p, max, var_hash TSRMLS_CC)) {
324324
zval_dtor(key);
325325
FREE_ZVAL(key);
326-
zval_dtor(data);
327-
FREE_ZVAL(data);
326+
zval_ptr_dtor(&data);
328327
return 0;
329328
}
330329

0 commit comments

Comments
 (0)