author | Craig Mohrman <craig.mohrman@oracle.com> |
Wed, 17 Jun 2015 15:47:38 -0700 | |
branch | s11-update |
changeset 4499 | 4e8085696007 |
permissions | -rw-r--r-- |
4499
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
1 |
CVE-2014-3669 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
2 |
Community BUG: |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
3 |
https://bugs.php.net/bug.php?id=68044 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
4 |
Community CODE: |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
5 |
http://git.php.net/?p=php-src.git;a=commit;h=56754a7f9eba0e4f559b6ca081d9f2a447b3f159 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
6 |
Below is the community patch. |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
7 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
8 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
9 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
10 |
From 56754a7f9eba0e4f559b6ca081d9f2a447b3f159 Mon Sep 17 00:00:00 2001 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
11 |
From: Stanislav Malyshev <[email protected]> |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
12 |
Date: Sun, 28 Sep 2014 14:19:31 -0700 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
13 |
Subject: [PATCH] Fixed bug #68044: Integer overflow in unserialize() (32-bits |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
14 |
only) |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
15 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
16 |
--- |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
17 |
NEWS | 5 ++++- |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
18 |
ext/standard/tests/serialize/bug68044.phpt | 12 ++++++++++++ |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
19 |
ext/standard/var_unserializer.c | 4 ++-- |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
20 |
ext/standard/var_unserializer.re | 2 +- |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
21 |
4 files changed, 19 insertions(+), 4 deletions(-) |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
22 |
create mode 100644 ext/standard/tests/serialize/bug68044.phpt |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
23 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
24 |
diff --git a/ext/standard/tests/serialize/bug68044.phpt b/ext/standard/tests/serialize/bug68044.phpt |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
25 |
new file mode 100644 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
26 |
index 0000000..031e44e |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
27 |
--- /dev/null |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
28 |
+++ b/ext/standard/tests/serialize/bug68044.phpt |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
29 |
@@ -0,0 +1,12 @@ |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
30 |
+--TEST-- |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
31 |
+Bug #68044 Integer overflow in unserialize() (32-bits only) |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
32 |
+--FILE-- |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
33 |
+<?php |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
34 |
+ echo unserialize('C:3:"XYZ":18446744075857035259:{}'); |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
35 |
+?> |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
36 |
+===DONE== |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
37 |
+--EXPECTF-- |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
38 |
+Warning: Insufficient data for unserializing - %d required, 1 present in %s/bug68044.php on line 2 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
39 |
+ |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
40 |
+Notice: unserialize(): Error at offset 32 of 33 bytes in %s/bug68044.php on line 2 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
41 |
+===DONE== |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
42 |
diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
43 |
index 657051f..8129da3 100644 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
44 |
--- a/ext/standard/var_unserializer.c |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
45 |
+++ b/ext/standard/var_unserializer.c |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
46 |
@@ -372,7 +372,7 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce) |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
47 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
48 |
(*p) += 2; |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
49 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
50 |
- if (datalen < 0 || (*p) + datalen >= max) { |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
51 |
+ if (datalen < 0 || (max - (*p)) <= datalen) { |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
52 |
zend_error(E_WARNING, "Insufficient data for unserializing - %ld required, %ld present", datalen, (long)(max - (*p))); |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
53 |
return 0; |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
54 |
} |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
55 |
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
56 |
index 1307508..6de1583 100644 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
57 |
--- a/ext/standard/var_unserializer.re |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
58 |
+++ b/ext/standard/var_unserializer.re |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
59 |
@@ -376,7 +376,7 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce) |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
60 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
61 |
(*p) += 2; |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
62 |
|
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
63 |
- if (datalen < 0 || (*p) + datalen >= max) { |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
64 |
+ if (datalen < 0 || (max - (*p)) <= datalen) { |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
65 |
zend_error(E_WARNING, "Insufficient data for unserializing - %ld required, %ld present", datalen, (long)(max - (*p))); |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
66 |
return 0; |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
67 |
} |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
68 |
-- |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
69 |
2.1.4 |
4e8085696007
20192108 problem in UTILITY/PHP
Craig Mohrman <craig.mohrman@oracle.com>
parents:
diff
changeset
|
70 |