mirror of
https://github.com/php/php-src.git
synced 2026-10-28 09:46:46 +08:00
3584a98bda
- Replace bailout on OOM with UnwindExit - Properly reset various globals that may be accessed during startup Fix GHSA-w8hw-w9fx-j79w (CVE-2026-109618) Fix GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com> Co-authored-by: Jakub Zelenka <bukka@php.net> Co-authored-by: Nora Dossche <7771979+ndossche@users.noreply.github.com> Co-authored-by: Nicolas Grekas <nicolas.grekas@gmail.com>
34 lines
805 B
PHP
34 lines
805 B
PHP
--TEST--
|
|
OOM unserialize() cleans up BG(unserialize) after a delayed OOM
|
|
--INI--
|
|
memory_limit=8M
|
|
--FILE--
|
|
<?php
|
|
|
|
register_shutdown_function(function () {
|
|
/* Runs after the fatal error. If the var_hash of the failed call were
|
|
* still installed, this call would nest into it and R:1 would resolve
|
|
* into that call's table instead of this array. */
|
|
var_dump(unserialize('a:1:{i:0;R:1;}'));
|
|
});
|
|
|
|
/* 40000 one-element arrays: ~760 KB serialized, ~10 MB unserialized. */
|
|
$n = 40000;
|
|
$ser = 'a:' . $n . ':{';
|
|
for ($i = 0; $i < $n; $i++) {
|
|
$ser .= 'i:' . $i . ';a:1:{i:0;i:0;}';
|
|
}
|
|
$ser .= '}';
|
|
|
|
unserialize($ser);
|
|
|
|
echo "not reached\n";
|
|
|
|
?>
|
|
--EXPECTF--
|
|
Fatal error: Allowed memory size of %d bytes exhausted %S(tried to allocate %d bytes) in %s on line %d
|
|
array(1) {
|
|
[0]=>
|
|
*RECURSION*
|
|
}
|