Another user-after-free vulnerability was found in unserialize(). We can create ZVAL and free it. During deserialization it will still allow to use R: or r: to set references to already freed memory, which could possibly lead to remote code execution.
Vulnerable code:
ALLOC_INIT_ZVAL(pentry);
if (!php_var_unserialize(&pentry, &p, s + buf_len, &var_hash TSRMLS_CC)) {
zval_ptr_dtor(&pentry);
goto outexcept;
}
var_push_dtor(&var_hash, &pentry);
if(Z_TYPE_P(pentry) != IS_OBJECT) {
goto outexcept;
}
ALLOC_INIT_ZVAL(pinf);
if (*p == ',') { /* new version has inf */
++p;
if (!php_var_unserialize(&pinf, &p, s + buf_len, &var_hash TSRMLS_CC)) {
zval_ptr_dtor(&pinf);
goto outexcept;
}
}
Upstream report:
https://bugs.php.net/bug.php?id=70365
Upstream patch:
http://git.php.net/?p=php-src.git;a=commit;h=f06a069c462d37c2e009f6d1d93b8c8e7b713393
Another user-after-free vulnerability was found in unserialize(). We can create ZVAL and free it. During deserialization it will still allow to use R: or r: to set references to already freed memory, which could possibly lead to remote code execution. Vulnerable code: ALLOC_INIT_ZVAL(pentry); if (!php_var_unserialize(&pentry, &p, s + buf_len, &var_hash TSRMLS_CC)) { zval_ptr_dtor(&pentry); goto outexcept; } var_push_dtor(&var_hash, &pentry); if(Z_TYPE_P(pentry) != IS_OBJECT) { goto outexcept; } ALLOC_INIT_ZVAL(pinf); if (*p == ',') { /* new version has inf */ ++p; if (!php_var_unserialize(&pinf, &p, s + buf_len, &var_hash TSRMLS_CC)) { zval_ptr_dtor(&pinf); goto outexcept; } } Upstream report: https://bugs.php.net/bug.php?id=70365 Upstream patch: http://git.php.net/?p=php-src.git;a=commit;h=f06a069c462d37c2e009f6d1d93b8c8e7b713393