Skip to content

Fixed buffer outflow during deserialization of map objects #132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 24, 2019

Conversation

rado-h
Copy link

@rado-h rado-h commented Jan 24, 2019

The same fix from #111 applied for the deserialization of maps.

@rtheunissen rtheunissen merged commit 3096126 into php-ds:master Jan 24, 2019
@rtheunissen
Copy link
Member

Thank you. Could you please explain to me how this allows for buffer overflow?

@rado-h
Copy link
Author

rado-h commented Jan 24, 2019

Not sure if either overflow or underflow is the most appropriate term here, I just went with the same name as the previous request. What happens is the serialization output from igbinary_serialize doesn't seem to contain any curly brackets so the condition for end might not be met.
For example, while the output of

serialize(new \DS\Map)

would be

C:6:"Ds\Map":0:{}"

the output of

igbinary_serialize(new \DS\Map)

would be

"���Ds\Map�"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants