1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
Subject: Fixed bug #52879 (Objects unreferenced in __get, __set, __isset or __unset can be freed too early).
Author: mail_ben_schmidt at yahoo dot com dot au
Origin: http://svn.php.net/viewvc?view=revision&revision=303913
Bug: http://bugs.php.net/52879
CVE-2010-4697
Patch is modified from upstream commit to remove edits to the NEWS file,
to reduce conflicts when applying patches and backported to apply to
earlier releases of php.
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -347,6 +347,9 @@ zval *zend_std_read_property(zval *objec
!guard->in_get) {
/* have getter - try with it! */
Z_ADDREF_P(object);
+ if (PZVAL_IS_REF(object)) {
+ SEPARATE_ZVAL(&object);
+ }
guard->in_get = 1; /* prevent circular getting */
rv = zend_std_call_getter(object, member TSRMLS_CC);
guard->in_get = 0;
@@ -436,22 +439,22 @@ static void zend_std_write_property(zval
}
}
} else {
- int setter_done = 0;
- zend_guard *guard;
+ zend_guard *guard = NULL;
if (zobj->ce->__set &&
zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
!guard->in_set) {
Z_ADDREF_P(object);
+ if (PZVAL_IS_REF(object)) {
+ SEPARATE_ZVAL(&object);
+ }
guard->in_set = 1; /* prevent circular setting */
if (zend_std_call_setter(object, member, value TSRMLS_CC) != SUCCESS) {
/* for now, just ignore it - __set should take care of warnings, etc. */
}
- setter_done = 1;
guard->in_set = 0;
zval_ptr_dtor(&object);
- }
- if (!setter_done && property_info) {
+ } else if (property_info) {
zval **foo;
/* if we assign referenced variable, we should separate it */
@@ -626,6 +629,9 @@ static void zend_std_unset_property(zval
!guard->in_unset) {
/* have unseter - try with it! */
Z_ADDREF_P(object);
+ if (PZVAL_IS_REF(object)) {
+ SEPARATE_ZVAL(&object);
+ }
guard->in_unset = 1; /* prevent circular unsetting */
zend_std_call_unsetter(object, member TSRMLS_CC);
guard->in_unset = 0;
@@ -1144,6 +1150,9 @@ static int zend_std_has_property(zval *o
/* have issetter - try with it! */
Z_ADDREF_P(object);
+ if (PZVAL_IS_REF(object)) {
+ SEPARATE_ZVAL(&object);
+ }
guard->in_isset = 1; /* prevent circular getting */
rv = zend_std_call_issetter(object, member TSRMLS_CC);
if (rv) {
--- /dev/null
+++ b/Zend/tests/bug52879.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #52879 (Objects unreferenced in __get, __set, __isset or __unset can be freed too early)
+--FILE--
+<?php
+class MyClass {
+ public $myRef;
+ public function __set($property,$value) {
+ $this->myRef = $value;
+ }
+}
+$myGlobal=new MyClass($myGlobal);
+$myGlobal->myRef=&$myGlobal;
+$myGlobal->myNonExistentProperty="ok\n";
+echo $myGlobal;
+--EXPECT--
+ok
|
