Skip to content

Commit 570d9b6

Browse files
krakjoekrakjoe
committed
Not serializable flag permeation
1 parent b382883 commit 570d9b6

File tree

89 files changed

+331
-287
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+331
-287
lines changed

‎Zend/tests/weakrefs/weakrefs_002.phpt

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,12 @@ try {
1212

1313
$wrs = 'O:13:"WeakReference":0:{}';
1414

15-
var_dump(@unserialize($wrs));
15+
try {
16+
var_dump(unserialize($wrs));
17+
} catch (Exception $ex) {
18+
var_dump($ex->getMessage());
19+
}
1620
?>
1721
--EXPECT--
1822
string(47) "Serialization of 'WeakReference' is not allowed"
19-
bool(false)
23+
string(49) "Unserialization of 'WeakReference' is not allowed"

‎Zend/zend_weakrefs.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -604,8 +604,6 @@ void zend_register_weakref_ce(void) /* {{{ */
604604
zend_ce_weakref = register_class_WeakReference();
605605

606606
zend_ce_weakref->create_object = zend_weakref_new;
607-
zend_ce_weakref->serialize = zend_class_serialize_deny;
608-
zend_ce_weakref->unserialize = zend_class_unserialize_deny;
609607

610608
memcpy(&zend_weakref_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers));
611609
zend_weakref_handlers.offset = XtOffsetOf(zend_weakref, std);
@@ -617,8 +615,6 @@ void zend_register_weakref_ce(void) /* {{{ */
617615

618616
zend_ce_weakmap->create_object = zend_weakmap_create_object;
619617
zend_ce_weakmap->get_iterator = zend_weakmap_get_iterator;
620-
zend_ce_weakmap->serialize = zend_class_serialize_deny;
621-
zend_ce_weakmap->unserialize = zend_class_unserialize_deny;
622618

623619
memcpy(&zend_weakmap_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers));
624620
zend_weakmap_handlers.offset = XtOffsetOf(zend_weakmap, std);

‎Zend/zend_weakrefs.stub.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,10 @@
22

33
/** @generate-class-entries */
44

5-
/** @strict-properties */
5+
/**
6+
* @strict-properties
7+
* @not-serializable
8+
*/
69
final class WeakReference
710
{
811
public function __construct() {}
@@ -12,7 +15,10 @@ public static function create(object $object): WeakReference {}
1215
public function get(): ?object {}
1316
}
1417

15-
/** @strict-properties */
18+
/**
19+
* @strict-properties
20+
* @not-serializable
21+
*/
1622
final class WeakMap implements ArrayAccess, Countable, IteratorAggregate
1723
{
1824
/** @param object $object */

‎Zend/zend_weakrefs_arginfo.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* This is a generated file, edit the .stub.php file instead.
2-
* Stub hash: c849da0cac9ed05fedacf10ef57449a4596b3c07 */
2+
* Stub hash: d91889851d9732d41e43fffddb6235d033c67534 */
33

44
ZEND_BEGIN_ARG_INFO_EX(arginfo_class_WeakReference___construct, 0, 0, 0)
55
ZEND_END_ARG_INFO()
@@ -70,7 +70,7 @@ static zend_class_entry *register_class_WeakReference(void)
7070

7171
INIT_CLASS_ENTRY(ce, "WeakReference", class_WeakReference_methods);
7272
class_entry = zend_register_internal_class_ex(&ce, NULL);
73-
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES;
73+
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES|ZEND_ACC_NOT_SERIALIZABLE;
7474

7575
return class_entry;
7676
}
@@ -81,7 +81,7 @@ static zend_class_entry *register_class_WeakMap(zend_class_entry *class_entry_Ar
8181

8282
INIT_CLASS_ENTRY(ce, "WeakMap", class_WeakMap_methods);
8383
class_entry = zend_register_internal_class_ex(&ce, NULL);
84-
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES;
84+
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES|ZEND_ACC_NOT_SERIALIZABLE;
8585
zend_class_implements(class_entry, 3, class_entry_ArrayAccess, class_entry_Countable, class_entry_IteratorAggregate);
8686

8787
return class_entry;

‎ext/com_dotnet/com_extension.c

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -174,21 +174,15 @@ PHP_MINIT_FUNCTION(com_dotnet)
174174
php_com_variant_class_entry = register_class_variant();
175175
php_com_variant_class_entry->create_object = php_com_object_new;
176176
php_com_variant_class_entry->get_iterator = php_com_iter_get;
177-
php_com_variant_class_entry->serialize = zend_class_serialize_deny;
178-
php_com_variant_class_entry->unserialize = zend_class_unserialize_deny;
179177

180178
tmp = register_class_com(php_com_variant_class_entry);
181179
tmp->create_object = php_com_object_new;
182180
tmp->get_iterator = php_com_iter_get;
183-
tmp->serialize = zend_class_serialize_deny;
184-
tmp->unserialize = zend_class_unserialize_deny;
185181

186182
#if HAVE_MSCOREE_H
187183
tmp = register_class_dotnet(php_com_variant_class_entry);
188184
tmp->create_object = php_com_object_new;
189185
tmp->get_iterator = php_com_iter_get;
190-
tmp->serialize = zend_class_serialize_deny;
191-
tmp->unserialize = zend_class_unserialize_deny;
192186
#endif
193187

194188
REGISTER_INI_ENTRIES();

‎ext/com_dotnet/com_extension.stub.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,9 @@ function com_message_pump(int $timeout_milliseconds = 0): bool {}
6666

6767
function com_load_typelib(string $typelib, bool $case_insensitive = true): bool {}
6868

69+
/**
70+
* @not-serializable
71+
*/
6972
class variant
7073
{
7174
public function __construct(mixed $value = null, int $type = VT_EMPTY, int $codepage = CP_ACP) {}

‎ext/com_dotnet/com_extension_arginfo.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* This is a generated file, edit the .stub.php file instead.
2-
* Stub hash: ba77cee0a718bcbe7ac280f07a41f9e97a8e2246 */
2+
* Stub hash: a2e260364d3f1f0e632b43be1a61294b21eed937 */
33

44
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_variant_set, 0, 2, IS_VOID, 0)
55
ZEND_ARG_OBJ_INFO(0, variant, variant, 0)
@@ -243,6 +243,7 @@ static zend_class_entry *register_class_variant(void)
243243

244244
INIT_CLASS_ENTRY(ce, "variant", class_variant_methods);
245245
class_entry = zend_register_internal_class_ex(&ce, NULL);
246+
class_entry->ce_flags |= ZEND_ACC_NOT_SERIALIZABLE;
246247

247248
return class_entry;
248249
}

‎ext/com_dotnet/tests/bug77177.phpt

Lines changed: 8 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,11 @@ foreach ($strings as $string) {
2626

2727
$strings = ['O:3:"com":0:{}', 'O:6:"dotnet":0:{}', 'O:7:"variant":0:{}'];
2828
foreach ($strings as $string) {
29-
var_dump(unserialize($string));
29+
try {
30+
unserialize($string);
31+
} catch (Exception $ex) {
32+
echo "Exception: {$ex->getMessage()}\n";
33+
}
3034
}
3135
?>
3236
--EXPECTF--
@@ -36,18 +40,6 @@ Exception: Serialization of 'variant' is not allowed
3640
Exception: Unserialization of 'com' is not allowed
3741
Exception: Unserialization of 'dotnet' is not allowed
3842
Exception: Unserialization of 'variant' is not allowed
39-
40-
Warning: Erroneous data format for unserializing 'com' in %s on line %d
41-
42-
Notice: unserialize(): Error at offset 13 of 14 bytes in %s on line %d
43-
bool(false)
44-
45-
Warning: Erroneous data format for unserializing 'dotnet' in %s on line %d
46-
47-
Notice: unserialize(): Error at offset 16 of 17 bytes in %s on line %d
48-
bool(false)
49-
50-
Warning: Erroneous data format for unserializing 'variant' in %s on line %d
51-
52-
Notice: unserialize(): Error at offset 17 of 18 bytes in %s on line %d
53-
bool(false)
43+
Exception: Unserialization of 'com' is not allowed
44+
Exception: Unserialization of 'dotnet' is not allowed
45+
Exception: Unserialization of 'variant' is not allowed

‎ext/curl/curl.stub.php

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,26 @@
22

33
/** @generate-class-entries */
44

5-
/** @strict-properties */
5+
/**
6+
* @strict-properties
7+
* @not-serializable
8+
*/
69
final class CurlHandle
710
{
811
}
912

10-
/** @strict-properties */
13+
/**
14+
* @strict-properties
15+
* @not-serializable
16+
*/
1117
final class CurlMultiHandle
1218
{
1319
}
1420

15-
/** @strict-properties */
21+
/**
22+
* @strict-properties
23+
* @not-serializable
24+
*/
1625
final class CurlShareHandle
1726
{
1827
}

‎ext/curl/curl_arginfo.h

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* This is a generated file, edit the .stub.php file instead.
2-
* Stub hash: 0b574385806ffec3ad96c1b584778cb53bd42535 */
2+
* Stub hash: c667191d35c8822b6e1f38ddd1e2743e78d4c3c0 */
33

44
ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_curl_close, 0, 1, IS_VOID, 0)
55
ZEND_ARG_OBJ_INFO(0, handle, CurlHandle, 0)
@@ -224,7 +224,7 @@ static zend_class_entry *register_class_CurlHandle(void)
224224

225225
INIT_CLASS_ENTRY(ce, "CurlHandle", class_CurlHandle_methods);
226226
class_entry = zend_register_internal_class_ex(&ce, NULL);
227-
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES;
227+
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES|ZEND_ACC_NOT_SERIALIZABLE;
228228

229229
return class_entry;
230230
}
@@ -235,7 +235,7 @@ static zend_class_entry *register_class_CurlMultiHandle(void)
235235

236236
INIT_CLASS_ENTRY(ce, "CurlMultiHandle", class_CurlMultiHandle_methods);
237237
class_entry = zend_register_internal_class_ex(&ce, NULL);
238-
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES;
238+
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES|ZEND_ACC_NOT_SERIALIZABLE;
239239

240240
return class_entry;
241241
}
@@ -246,7 +246,7 @@ static zend_class_entry *register_class_CurlShareHandle(void)
246246

247247
INIT_CLASS_ENTRY(ce, "CurlShareHandle", class_CurlShareHandle_methods);
248248
class_entry = zend_register_internal_class_ex(&ce, NULL);
249-
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES;
249+
class_entry->ce_flags |= ZEND_ACC_FINAL|ZEND_ACC_NO_DYNAMIC_PROPERTIES|ZEND_ACC_NOT_SERIALIZABLE;
250250

251251
return class_entry;
252252
}

‎ext/curl/curl_file.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@
2020

2121
#include "php.h"
2222
#include "Zend/zend_exceptions.h"
23-
#include "Zend/zend_interfaces.h"
2423
#include "curl_private.h"
2524
#include "curl_file_arginfo.h"
2625

@@ -147,8 +146,6 @@ ZEND_METHOD(CURLStringFile, __construct)
147146
void curlfile_register_class(void)
148147
{
149148
curl_CURLFile_class = register_class_CURLFile();
150-
curl_CURLFile_class->serialize = zend_class_serialize_deny;
151-
curl_CURLFile_class->unserialize = zend_class_unserialize_deny;
152149

153150
curl_CURLStringFile_class = register_class_CURLStringFile();
154151
}

‎ext/curl/curl_file.stub.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22

33
/** @generate-class-entries */
44

5+
/**
6+
* @not-serializable
7+
*/
58
class CURLFile
69
{
710
public string $name = "";

‎ext/curl/curl_file_arginfo.h

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/* This is a generated file, edit the .stub.php file instead.
2-
* Stub hash: 6cc8d65814e0a45d71cdf765533e85353e749051 */
2+
* Stub hash: 63d47eac83ee088e8b4c0d1aa469de9ae066146a */
33

44
ZEND_BEGIN_ARG_INFO_EX(arginfo_class_CURLFile___construct, 0, 0, 1)
55
ZEND_ARG_TYPE_INFO(0, filename, IS_STRING, 0)
@@ -60,6 +60,7 @@ static zend_class_entry *register_class_CURLFile(void)
6060

6161
INIT_CLASS_ENTRY(ce, "CURLFile", class_CURLFile_methods);
6262
class_entry = zend_register_internal_class_ex(&ce, NULL);
63+
class_entry->ce_flags |= ZEND_ACC_NOT_SERIALIZABLE;
6364

6465
zval property_name_default_value;
6566
ZVAL_EMPTY_STRING(&property_name_default_value);

‎ext/curl/interface.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@
2121
#endif
2222

2323
#include "php.h"
24-
#include "Zend/zend_interfaces.h"
2524
#include "Zend/zend_exceptions.h"
2625

2726
#include <stdio.h>
@@ -1189,8 +1188,6 @@ PHP_MINIT_FUNCTION(curl)
11891188

11901189
curl_ce = register_class_CurlHandle();
11911190
curl_ce->create_object = curl_create_object;
1192-
curl_ce->serialize = zend_class_serialize_deny;
1193-
curl_ce->unserialize = zend_class_unserialize_deny;
11941191

11951192
memcpy(&curl_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));
11961193
curl_object_handlers.offset = XtOffsetOf(php_curl, std);

‎ext/curl/multi.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@
2121
#endif
2222

2323
#include "php.h"
24-
#include "Zend/zend_interfaces.h"
2524
#include "Zend/zend_smart_str.h"
2625

2726
#include "curl_private.h"
@@ -582,8 +581,6 @@ static HashTable *curl_multi_get_gc(zend_object *object, zval **table, int *n)
582581

583582
void curl_multi_register_handlers(void) {
584583
curl_multi_ce->create_object = curl_multi_create_object;
585-
curl_multi_ce->serialize = zend_class_serialize_deny;
586-
curl_multi_ce->unserialize = zend_class_unserialize_deny;
587584

588585
memcpy(&curl_multi_handlers, &std_object_handlers, sizeof(zend_object_handlers));
589586
curl_multi_handlers.offset = XtOffsetOf(php_curlm, std);

‎ext/curl/share.c

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@
2121
#endif
2222

2323
#include "php.h"
24-
#include "Zend/zend_interfaces.h"
2524

2625
#include "curl_private.h"
2726

@@ -164,8 +163,6 @@ void curl_share_free_obj(zend_object *object)
164163

165164
void curl_share_register_handlers(void) {
166165
curl_share_ce->create_object = curl_share_create_object;
167-
curl_share_ce->serialize = &zend_class_serialize_deny;
168-
curl_share_ce->unserialize = &zend_class_unserialize_deny;
169166

170167
memcpy(&curl_share_handlers, &std_object_handlers, sizeof(zend_object_handlers));
171168
curl_share_handlers.offset = XtOffsetOf(php_curlsh, std);

‎ext/curl/tests/bug73147.phpt

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,12 @@ Bug #73147: Use After Free in PHP7 unserialize()
44
curl
55
--FILE--
66
<?php
7-
87
$poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
98
try {
109
var_dump(unserialize($poc));
1110
} catch(Exception $e) {
1211
echo $e->getMessage();
1312
}
1413
?>
15-
--EXPECTF--
16-
Warning: Erroneous data format for unserializing 'CURLFile' in %s on line %d
17-
18-
Notice: unserialize(): Error at offset 27 of 44 bytes in %s on line %d
19-
bool(false)
14+
--EXPECT--
15+
Unserialization of 'CURLFile' is not allowed

‎ext/enchant/enchant.c

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@
2222
#include "php.h"
2323
#include "php_ini.h"
2424
#include "ext/standard/info.h"
25-
#include "Zend/zend_interfaces.h"
2625
#include "Zend/zend_exceptions.h"
2726
#include "../spl/spl_exceptions.h"
2827
#include <enchant.h>
@@ -188,8 +187,6 @@ PHP_MINIT_FUNCTION(enchant)
188187
{
189188
enchant_broker_ce = register_class_EnchantBroker();
190189
enchant_broker_ce->create_object = enchant_broker_create_object;
191-
enchant_broker_ce->serialize = zend_class_serialize_deny;
192-
enchant_broker_ce->unserialize = zend_class_unserialize_deny;
193190

194191
memcpy(&enchant_broker_handlers, &std_object_handlers, sizeof(zend_object_handlers));
195192
enchant_broker_handlers.offset = XtOffsetOf(enchant_broker, std);
@@ -199,8 +196,6 @@ PHP_MINIT_FUNCTION(enchant)
199196

200197
enchant_dict_ce = register_class_EnchantDictionary();
201198
enchant_dict_ce->create_object = enchant_dict_create_object;
202-
enchant_dict_ce->serialize = zend_class_serialize_deny;
203-
enchant_dict_ce->unserialize = zend_class_unserialize_deny;
204199

205200
memcpy(&enchant_dict_handlers, &std_object_handlers, sizeof(zend_object_handlers));
206201
enchant_dict_handlers.offset = XtOffsetOf(enchant_dict, std);

‎ext/enchant/enchant.stub.php

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,18 @@
22

33
/** @generate-class-entries */
44

5-
/** @strict-properties */
5+
/**
6+
* @strict-properties
7+
* @not-serializable
8+
*/
69
final class EnchantBroker
710
{
811
}
912

10-
/** @strict-properties */
13+
/**
14+
* @strict-properties
15+
* @not-serializable
16+
*/
1117
final class EnchantDictionary
1218
{
1319
}

0 commit comments

Comments
 (0)