diff options
| author | Xinchen Hui <laruence@php.net> | 2015-07-07 21:25:28 +0800 |
|---|---|---|
| committer | Ferenc Kovacs <tyrael@php.net> | 2015-07-10 02:27:09 +0200 |
| commit | 1f4a84109549480a40b3c3b49456aa7bb4105bac (patch) | |
| tree | f6b3084366c028c482157e3a3010e6a4f58e5146 | |
| parent | d1370e201609b0a9010a83bed9071c2a39741612 (diff) | |
| download | php-git-1f4a84109549480a40b3c3b49456aa7bb4105bac.tar.gz | |
Fixed bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex())
| -rw-r--r-- | ext/spl/spl_iterators.c | 8 | ||||
| -rw-r--r-- | ext/spl/tests/bug69970.phpt | 45 |
2 files changed, 50 insertions, 3 deletions
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c index 8588c7a038..359d94d6ed 100644 --- a/ext/spl/spl_iterators.c +++ b/ext/spl/spl_iterators.c @@ -380,9 +380,11 @@ next_step: } } } - iterator->funcs->dtor(iterator TSRMLS_CC); - zval_ptr_dtor(&object->iterators[object->level].zobject); - object->level--; + if (object->level > 0) { + iterator->funcs->dtor(iterator TSRMLS_CC); + zval_ptr_dtor(&object->iterators[object->level].zobject); + object->level--; + } } else { return; /* done completeley */ } diff --git a/ext/spl/tests/bug69970.phpt b/ext/spl/tests/bug69970.phpt new file mode 100644 index 0000000000..a488037b8c --- /dev/null +++ b/ext/spl/tests/bug69970.phpt @@ -0,0 +1,45 @@ +--TEST-- +Bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()) +--FILE-- +<?php + +$count = 10; + +class RecursiveArrayIteratorIterator extends RecursiveIteratorIterator { + function rewind() { + echo "dummy\n"; + } + function endChildren() { + global $count; + echo $this->getDepth(); + if (--$count > 0) { + // Trigger use-after-free + parent::rewind(); + } + } +} +$arr = array("a", array("ba", array("bba", "bbb"))); +$obj = new RecursiveArrayIterator($arr); +$rit = new RecursiveArrayIteratorIterator($obj); + +foreach ($rit as $k => $v) { + echo ($rit->getDepth()) . "$k=>$v\n"; +} +?> +--EXPECT-- +dummy +00=>a +00=>a +10=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21010=>ba +20=>bba +21=>bbb +21 |