summaryrefslogtreecommitdiff
path: root/ext/standard/var_unserializer.c
diff options
context:
space:
mode:
Diffstat (limited to 'ext/standard/var_unserializer.c')
-rw-r--r--ext/standard/var_unserializer.c74
1 files changed, 40 insertions, 34 deletions
diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 108887580f..8c16a555fd 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.16 */
+/* Generated by re2c 1.0.1 */
#line 1 "ext/standard/var_unserializer.re"
/*
+----------------------------------------------------------------------+
@@ -519,6 +519,13 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
return 0;
}
+ /* Check that '}' is present before calling ce->unserialize() to mitigate issues
+ * with unserialize reading past the end of the passed buffer if the string is not
+ * appropriately terminated (usually NUL terminated, but '}' is also sufficient.) */
+ if ((*p)[datalen] != '}') {
+ return 0;
+ }
+
if (ce->unserialize == NULL) {
zend_error(E_WARNING, "Class %s has no unserializer", ZSTR_VAL(ce->name));
object_init_ex(rval, ce);
@@ -526,9 +533,8 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
return 0;
}
- (*p) += datalen;
-
- return finish_nested_data(UNSERIALIZE_PASSTHRU);
+ (*p) += datalen + 1; /* +1 for '}' */
+ return 1;
}
static inline zend_long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
@@ -645,7 +651,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
start = cursor;
-#line 649 "ext/standard/var_unserializer.c"
+#line 655 "ext/standard/var_unserializer.c"
{
YYCTYPE yych;
static const unsigned char yybm[] = {
@@ -703,9 +709,9 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
yy2:
++YYCURSOR;
yy3:
-#line 1036 "ext/standard/var_unserializer.re"
+#line 1042 "ext/standard/var_unserializer.re"
{ return 0; }
-#line 709 "ext/standard/var_unserializer.c"
+#line 715 "ext/standard/var_unserializer.c"
yy4:
yych = *(YYMARKER = ++YYCURSOR);
if (yych == ':') goto yy17;
@@ -752,13 +758,13 @@ yy14:
goto yy3;
yy15:
++YYCURSOR;
-#line 1030 "ext/standard/var_unserializer.re"
+#line 1036 "ext/standard/var_unserializer.re"
{
/* this is the case where we have less data than planned */
php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
return 0; /* not sure if it should be 0 or 1 here? */
}
-#line 762 "ext/standard/var_unserializer.c"
+#line 768 "ext/standard/var_unserializer.c"
yy17:
yych = *++YYCURSOR;
if (yybm[0+yych] & 128) {
@@ -769,13 +775,13 @@ yy18:
goto yy3;
yy19:
++YYCURSOR;
-#line 702 "ext/standard/var_unserializer.re"
+#line 708 "ext/standard/var_unserializer.re"
{
*p = YYCURSOR;
ZVAL_NULL(rval);
return 1;
}
-#line 779 "ext/standard/var_unserializer.c"
+#line 785 "ext/standard/var_unserializer.c"
yy21:
yych = *++YYCURSOR;
if (yych <= '/') goto yy18;
@@ -974,7 +980,7 @@ yy55:
goto yy18;
yy56:
++YYCURSOR;
-#line 653 "ext/standard/var_unserializer.re"
+#line 659 "ext/standard/var_unserializer.re"
{
zend_long id;
@@ -999,7 +1005,7 @@ yy56:
return 1;
}
-#line 1003 "ext/standard/var_unserializer.c"
+#line 1009 "ext/standard/var_unserializer.c"
yy58:
yych = *++YYCURSOR;
if (yych == '"') goto yy77;
@@ -1010,13 +1016,13 @@ yy59:
goto yy18;
yy60:
++YYCURSOR;
-#line 708 "ext/standard/var_unserializer.re"
+#line 714 "ext/standard/var_unserializer.re"
{
*p = YYCURSOR;
ZVAL_BOOL(rval, parse_iv(start + 2));
return 1;
}
-#line 1020 "ext/standard/var_unserializer.c"
+#line 1026 "ext/standard/var_unserializer.c"
yy62:
++YYCURSOR;
if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
@@ -1036,7 +1042,7 @@ yy62:
}
yy64:
++YYCURSOR;
-#line 756 "ext/standard/var_unserializer.re"
+#line 762 "ext/standard/var_unserializer.re"
{
#if SIZEOF_ZEND_LONG == 4
use_double:
@@ -1045,7 +1051,7 @@ use_double:
ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
return 1;
}
-#line 1049 "ext/standard/var_unserializer.c"
+#line 1055 "ext/standard/var_unserializer.c"
yy66:
yych = *++YYCURSOR;
if (yych <= ',') {
@@ -1067,7 +1073,7 @@ yy68:
goto yy18;
yy69:
++YYCURSOR;
-#line 714 "ext/standard/var_unserializer.re"
+#line 720 "ext/standard/var_unserializer.re"
{
#if SIZEOF_ZEND_LONG == 4
int digits = YYCURSOR - start - 3;
@@ -1093,14 +1099,14 @@ yy69:
ZVAL_LONG(rval, parse_iv(start + 2));
return 1;
}
-#line 1097 "ext/standard/var_unserializer.c"
+#line 1103 "ext/standard/var_unserializer.c"
yy71:
yych = *++YYCURSOR;
if (yych == '"') goto yy85;
goto yy18;
yy72:
++YYCURSOR;
-#line 678 "ext/standard/var_unserializer.re"
+#line 684 "ext/standard/var_unserializer.re"
{
zend_long id;
@@ -1124,14 +1130,14 @@ yy72:
return 1;
}
-#line 1128 "ext/standard/var_unserializer.c"
+#line 1134 "ext/standard/var_unserializer.c"
yy74:
yych = *++YYCURSOR;
if (yych == '"') goto yy87;
goto yy18;
yy75:
++YYCURSOR;
-#line 878 "ext/standard/var_unserializer.re"
+#line 884 "ext/standard/var_unserializer.re"
{
size_t len, len2, len3, maxlen;
zend_long elements;
@@ -1283,10 +1289,10 @@ yy75:
return object_common2(UNSERIALIZE_PASSTHRU, elements);
}
-#line 1287 "ext/standard/var_unserializer.c"
+#line 1293 "ext/standard/var_unserializer.c"
yy77:
++YYCURSOR;
-#line 803 "ext/standard/var_unserializer.re"
+#line 809 "ext/standard/var_unserializer.re"
{
size_t len, maxlen;
zend_string *str;
@@ -1320,10 +1326,10 @@ yy77:
ZVAL_STR(rval, str);
return 1;
}
-#line 1324 "ext/standard/var_unserializer.c"
+#line 1330 "ext/standard/var_unserializer.c"
yy79:
++YYCURSOR;
-#line 837 "ext/standard/var_unserializer.re"
+#line 843 "ext/standard/var_unserializer.re"
{
zend_long elements = parse_iv(start + 2);
/* use iv() not uiv() in order to check data range */
@@ -1353,7 +1359,7 @@ yy79:
return finish_nested_data(UNSERIALIZE_PASSTHRU);
}
-#line 1357 "ext/standard/var_unserializer.c"
+#line 1363 "ext/standard/var_unserializer.c"
yy81:
yych = *++YYCURSOR;
if (yych <= '/') goto yy18;
@@ -1372,7 +1378,7 @@ yy84:
goto yy18;
yy85:
++YYCURSOR;
-#line 867 "ext/standard/var_unserializer.re"
+#line 873 "ext/standard/var_unserializer.re"
{
zend_long elements;
if (!var_hash) return 0;
@@ -1383,10 +1389,10 @@ yy85:
}
return object_common2(UNSERIALIZE_PASSTHRU, elements);
}
-#line 1387 "ext/standard/var_unserializer.c"
+#line 1393 "ext/standard/var_unserializer.c"
yy87:
++YYCURSOR;
-#line 765 "ext/standard/var_unserializer.re"
+#line 771 "ext/standard/var_unserializer.re"
{
size_t len, maxlen;
char *str;
@@ -1424,10 +1430,10 @@ yy87:
}
return 1;
}
-#line 1428 "ext/standard/var_unserializer.c"
+#line 1434 "ext/standard/var_unserializer.c"
yy89:
++YYCURSOR;
-#line 740 "ext/standard/var_unserializer.re"
+#line 746 "ext/standard/var_unserializer.re"
{
*p = YYCURSOR;
@@ -1443,9 +1449,9 @@ yy89:
return 1;
}
-#line 1447 "ext/standard/var_unserializer.c"
+#line 1453 "ext/standard/var_unserializer.c"
}
-#line 1038 "ext/standard/var_unserializer.re"
+#line 1044 "ext/standard/var_unserializer.re"
return 0;
View Lorry Controller Status