Skip to content

Commit 3376634

Browse files
weltlingweltling
committed
Merge remote-tracking branch 'phpsec/PHP-5.6.28' into PHP-5.6
2 parents 493b2bf + 99b242a commit 3376634

File tree

13 files changed

+139
-85
lines changed

13 files changed

+139
-85
lines changed

‎ext/gd/libgd/gd.c

Lines changed: 4 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -1117,7 +1117,7 @@ void gdImageLine (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
11171117
}
11181118

11191119
/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
1120-
if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
1120+
if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
11211121
return;
11221122
}
11231123

@@ -1301,55 +1301,10 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
13011301
long x, y, inc, frac;
13021302
long dx, dy,tmp;
13031303

1304-
if (y1 < 0 && y2 < 0) {
1305-
return;
1306-
}
1307-
if (y1 < 0) {
1308-
x1 += (y1 * (x1 - x2)) / (y2 - y1);
1309-
y1 = 0;
1310-
}
1311-
if (y2 < 0) {
1312-
x2 += (y2 * (x1 - x2)) / (y2 - y1);
1313-
y2 = 0;
1314-
}
1315-
1316-
/* bottom edge */
1317-
if (y1 >= im->sy && y2 >= im->sy) {
1318-
return;
1319-
}
1320-
if (y1 >= im->sy) {
1321-
x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
1322-
y1 = im->sy - 1;
1323-
}
1324-
if (y2 >= im->sy) {
1325-
x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
1326-
y2 = im->sy - 1;
1327-
}
1328-
1329-
/* left edge */
1330-
if (x1 < 0 && x2 < 0) {
1331-
return;
1332-
}
1333-
if (x1 < 0) {
1334-
y1 += (x1 * (y1 - y2)) / (x2 - x1);
1335-
x1 = 0;
1336-
}
1337-
if (x2 < 0) {
1338-
y2 += (x2 * (y1 - y2)) / (x2 - x1);
1339-
x2 = 0;
1340-
}
1341-
/* right edge */
1342-
if (x1 >= im->sx && x2 >= im->sx) {
1304+
/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
1305+
if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
13431306
return;
13441307
}
1345-
if (x1 >= im->sx) {
1346-
y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
1347-
x1 = im->sx - 1;
1348-
}
1349-
if (x2 >= im->sx) {
1350-
y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
1351-
x2 = im->sx - 1;
1352-
}
13531308

13541309
dx = x2 - x1;
13551310
dy = y2 - y1;
@@ -1792,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
17921747
int leftLimit = -1, rightLimit;
17931748
int i, restoreAlphaBlending = 0;
17941749

1795-
if (border < 0) {
1750+
if (border < 0 || color < 0) {
17961751
/* Refuse to fill to a non-solid border */
17971752
return;
17981753
}

‎ext/gd/tests/bug72482.phpt

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
--TEST--
2+
Bug #72482 (Ilegal write/read access caused by gdImageAALine overflow)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('gd')) die('skip gd extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$img = imagecreatetruecolor(13, 1007);
10+
imageantialias($img, true);
11+
imageline($img, 0, 0, 1073745919, 1073745919, 4096);
12+
13+
$img = imagecreatetruecolor(100, 100);
14+
imageantialias($img, true);
15+
imageline($img, 1094795585, 0, 2147483647, 255, 0xff);
16+
?>
17+
===DONE===
18+
--EXPECT--
19+
===DONE===

‎ext/gd/tests/bug72482_2.phpt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
--TEST--
2+
Bug 72482 (Ilegal write/read access caused by gdImageAALine overflow)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('gd')) die('skip gd extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
10+
11+
$im = imagecreatetruecolor(10, 10);
12+
imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
13+
imageantialias($im, true);
14+
imageline($im, 0, 0, 10, 10, imagecolorallocate($im, 0, 0, 0));
15+
16+
test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug72482_2.png', $im);
17+
?>
18+
===DONE===
19+
--EXPECT--
20+
The images are equal.
21+
===DONE===

‎ext/gd/tests/bug72482_2.png

118 Bytes
Loading

‎ext/gd/tests/bug72696.phpt

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
--TEST--
2+
Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded('gd')) die('skip gd extension not available');
6+
?>
7+
--FILE--
8+
<?php
9+
$im = imagecreatetruecolor(10, 10);
10+
imagefilltoborder($im, 0, 0, 1, -2);
11+
?>
12+
===DONE===
13+
--EXPECT--
14+
===DONE===

‎ext/imap/php_imap.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3900,7 +3900,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
39003900
char *tsm_errmsg = NULL;
39013901
ADDRESS *addr;
39023902
char *bufferTo = NULL, *bufferCc = NULL, *bufferBcc = NULL, *bufferHeader = NULL;
3903-
int offset, bufferLen = 0;
3903+
size_t offset, bufferLen = 0;
39043904
size_t bt_len;
39053905

39063906
if (headers) {

‎ext/pdo/pdo_stmt.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2338,6 +2338,7 @@ void pdo_stmt_init(TSRMLS_D)
23382338
pdo_row_ce->ce_flags |= ZEND_ACC_FINAL_CLASS; /* when removing this a lot of handlers need to be redone */
23392339
pdo_row_ce->create_object = pdo_row_new;
23402340
pdo_row_ce->serialize = pdo_row_serialize;
2341+
pdo_row_ce->unserialize = zend_class_unserialize_deny;
23412342
}
23422343

23432344
static void free_statement(pdo_stmt_t *stmt TSRMLS_DC)

‎ext/spl/spl_array.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1812,7 +1812,7 @@ SPL_METHOD(Array, unserialize)
18121812
ALLOC_INIT_ZVAL(intern->array);
18131813
if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)
18141814
|| (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) {
1815-
zval_ptr_dtor(&intern->array);
1815+
// zval_ptr_dtor(&intern->array);
18161816
goto outexcept;
18171817
}
18181818
var_push_dtor(&var_hash, &intern->array);

‎ext/standard/tests/serialize/bug73341.phpt

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
Bug #73144 (Use-afte-free in ArrayObject Deserialization)
3+
--FILE--
4+
<?php
5+
try {
6+
$token = 'a:2:{i:0;O:1:"0":2:0s:1:"0";i:0;s:1:"0";a:1:{i:0;C:11:"ArrayObject":7:0x:i:0;r0';
7+
$obj = unserialize($token);
8+
} catch(Exception $e) {
9+
echo $e->getMessage()."\n";
10+
}
11+
12+
try {
13+
$inner = 'x:i:1;O:8:"stdClass":1:{};m:a:0:{}';
14+
$exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}';
15+
unserialize($exploit);
16+
} catch(Exception $e) {
17+
echo $e->getMessage()."\n";
18+
}
19+
?>
20+
--EXPECTF--
21+
Error at offset 6 of 7 bytes
22+
23+
Notice: ArrayObject::unserialize(): Unexpected end of serialized data in %sbug73341.php on line %d
24+
Error at offset 24 of 34 bytes

‎ext/wddx/tests/bug45901.phpt

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,5 +14,7 @@ echo wddx_serialize_value($xml, 'Variables') . "\n";
1414
echo "DONE";
1515
?>
1616
--EXPECTF--
17-
<wddxPacket version='1.0'><header><comment>Variables</comment></header><data><struct><var name='php_class_name'><string>SimpleXMLElement</string></var><var name='test'><struct><var name='php_class_name'><string>SimpleXMLElement</string></var></struct></var></struct></data></wddxPacket>
17+
18+
Warning: wddx_serialize_value(): Class SimpleXMLElement can not be serialized in %sbug45901.php on line %d
19+
<wddxPacket version='1.0'><header><comment>Variables</comment></header><data></data></wddxPacket>
1820
DONE

‎ext/wddx/tests/bug72790.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
--TEST--
2-
Bug 72790: wddx_deserialize null dereference with invalid xml
2+
Bug #72790: wddx_deserialize null dereference with invalid xml
33
--SKIPIF--
44
<?php
55
if (!extension_loaded('wddx')) {

‎ext/wddx/tests/bug73331.phpt

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
--TEST--
2+
Bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow)
3+
--SKIPIF--
4+
<?php if (!extension_loaded("wddx") || !extension_loaded("pdo")) print "skip"; ?>
5+
--FILE--
6+
<?php
7+
8+
$wddx = "<wddxPacket version='1.0'><header/><data><struct><var name='php_class_name'><string>PDORow</string></var></struct></data></wddxPacket>";
9+
var_dump(wddx_deserialize($wddx));
10+
?>
11+
--EXPECTF--
12+
13+
Warning: wddx_deserialize(): Class pdorow can not be unserialized in %s73331.php on line %d
14+
NULL
15+

‎ext/wddx/wddx.c

Lines changed: 35 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -471,21 +471,26 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
471471
ulong idx;
472472
char tmp_buf[WDDX_BUF_LEN];
473473
HashTable *objhash, *sleephash;
474+
zend_class_entry *ce;
475+
PHP_CLASS_ATTRIBUTES;
474476
TSRMLS_FETCH();
475477

478+
PHP_SET_CLASS_ATTRIBUTES(obj);
479+
ce = Z_OBJCE_P(obj);
480+
if (!ce || ce->serialize || ce->unserialize) {
481+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Class %s can not be serialized", class_name);
482+
PHP_CLEANUP_CLASS_ATTRIBUTES();
483+
return;
484+
}
485+
476486
MAKE_STD_ZVAL(fname);
477487
ZVAL_STRING(fname, "__sleep", 1);
478-
479488
/*
480489
* We try to call __sleep() method on object. It's supposed to return an
481490
* array of property names to be serialized.
482491
*/
483492
if (call_user_function_ex(CG(function_table), &obj, fname, &retval, 0, 0, 1, NULL TSRMLS_CC) == SUCCESS) {
484493
if (retval && (sleephash = HASH_OF(retval))) {
485-
PHP_CLASS_ATTRIBUTES;
486-
487-
PHP_SET_CLASS_ATTRIBUTES(obj);
488-
489494
php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
490495
snprintf(tmp_buf, WDDX_BUF_LEN, WDDX_VAR_S, PHP_CLASS_NAME_VAR);
491496
php_wddx_add_chunk(packet, tmp_buf);
@@ -494,8 +499,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
494499
php_wddx_add_chunk_static(packet, WDDX_STRING_E);
495500
php_wddx_add_chunk_static(packet, WDDX_VAR_E);
496501

497-
PHP_CLEANUP_CLASS_ATTRIBUTES();
498-
499502
objhash = HASH_OF(obj);
500503

501504
for (zend_hash_internal_pointer_reset(sleephash);
@@ -516,10 +519,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
516519
} else {
517520
uint key_len;
518521

519-
PHP_CLASS_ATTRIBUTES;
520-
521-
PHP_SET_CLASS_ATTRIBUTES(obj);
522-
523522
php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
524523
snprintf(tmp_buf, WDDX_BUF_LEN, WDDX_VAR_S, PHP_CLASS_NAME_VAR);
525524
php_wddx_add_chunk(packet, tmp_buf);
@@ -528,8 +527,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
528527
php_wddx_add_chunk_static(packet, WDDX_STRING_E);
529528
php_wddx_add_chunk_static(packet, WDDX_VAR_E);
530529

531-
PHP_CLEANUP_CLASS_ATTRIBUTES();
532-
533530
objhash = HASH_OF(obj);
534531
for (zend_hash_internal_pointer_reset(objhash);
535532
zend_hash_get_current_data(objhash, (void**)&ent) == SUCCESS;
@@ -551,6 +548,8 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
551548
php_wddx_add_chunk_static(packet, WDDX_STRUCT_E);
552549
}
553550

551+
PHP_CLEANUP_CLASS_ATTRIBUTES();
552+
554553
zval_dtor(fname);
555554
FREE_ZVAL(fname);
556555

@@ -1012,26 +1011,30 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
10121011
pce = &PHP_IC_ENTRY;
10131012
}
10141013

1015-
/* Initialize target object */
1016-
MAKE_STD_ZVAL(obj);
1017-
object_init_ex(obj, *pce);
1018-
1019-
/* Merge current hashtable with object's default properties */
1020-
zend_hash_merge(Z_OBJPROP_P(obj),
1021-
Z_ARRVAL_P(ent2->data),
1022-
(void (*)(void *)) zval_add_ref,
1023-
(void *) &tmp, sizeof(zval *), 0);
1024-
1025-
if (incomplete_class) {
1026-
php_store_class_name(obj, Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));
1014+
if (pce != &PHP_IC_ENTRY && ((*pce)->serialize || (*pce)->unserialize)) {
1015+
ent2->data = NULL;
1016+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "Class %s can not be unserialized", Z_STRVAL_P(ent1->data));
1017+
} else {
1018+
/* Initialize target object */
1019+
MAKE_STD_ZVAL(obj);
1020+
object_init_ex(obj, *pce);
1021+
1022+
/* Merge current hashtable with object's default properties */
1023+
zend_hash_merge(Z_OBJPROP_P(obj),
1024+
Z_ARRVAL_P(ent2->data),
1025+
(void (*)(void *)) zval_add_ref,
1026+
(void *) &tmp, sizeof(zval *), 0);
1027+
1028+
if (incomplete_class) {
1029+
php_store_class_name(obj, Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));
1030+
}
1031+
1032+
/* Clean up old array entry */
1033+
zval_ptr_dtor(&ent2->data);
1034+
1035+
/* Set stack entry to point to the newly created object */
1036+
ent2->data = obj;
10271037
}
1028-
1029-
/* Clean up old array entry */
1030-
zval_ptr_dtor(&ent2->data);
1031-
1032-
/* Set stack entry to point to the newly created object */
1033-
ent2->data = obj;
1034-
10351038
/* Clean up class name var entry */
10361039
zval_ptr_dtor(&ent1->data);
10371040
} else if (Z_TYPE_P(ent2->data) == IS_OBJECT) {

0 commit comments

Comments
 (0)