mirror of
https://github.com/php/php-src.git
synced 2026-10-28 09:46:46 +08:00
3584a98bda
- Replace bailout on OOM with UnwindExit - Properly reset various globals that may be accessed during startup Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> Co-authored-by: Jakub Zelenka <bukka@php.net> Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com> Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
29 lines
681 B
PHP
29 lines
681 B
PHP
--TEST--
|
|
OOM unserialize() object __unserialize (2)
|
|
--INI--
|
|
memory_limit=200M
|
|
--FILE--
|
|
<?php
|
|
|
|
class C {
|
|
public function __unserialize($data) {
|
|
}
|
|
}
|
|
|
|
$chunks = [];
|
|
$chunksize = 128;
|
|
for ($i = 0; $i < 1024*1024; $i++) {
|
|
$chunkIdx = (int)($i / $chunksize);
|
|
$prop = sprintf('p%d', $i);
|
|
$chunks[$chunkIdx] = ($chunks[$chunkIdx] ?? '') . sprintf('s:%d:"%s";i:%d;', strlen($prop), $prop, $i);
|
|
}
|
|
$payload = 'O:1:"C":'.$i.':{'.implode('', $chunks).'}';
|
|
$chunks = null;
|
|
|
|
ini_set('memory_limit', '100m');
|
|
var_dump(gettype(unserialize($payload)));
|
|
|
|
?>
|
|
--EXPECTF--
|
|
Fatal error: Allowed memory size of 104857600 bytes exhausted %S(tried to allocate %d bytes) in %s on line 19
|