Skip to content

Fixed buffer outflow during deserialization of map objects#132

Merged
rtheunissen merged 1 commit into
php-ds:masterfrom
rado-h:unserialize-map-fixes
Jan 24, 2019
Merged

Fixed buffer outflow during deserialization of map objects#132
rtheunissen merged 1 commit into
php-ds:masterfrom
rado-h:unserialize-map-fixes

Conversation

@rado-h

@rado-h rado-h commented Jan 24, 2019

Copy link
Copy Markdown

The same fix from #111 applied for the deserialization of maps.

@rtheunissen
rtheunissen merged commit 3096126 into php-ds:master Jan 24, 2019
@rtheunissen

Copy link
Copy Markdown
Member

Thank you. Could you please explain to me how this allows for buffer overflow?

@rado-h

rado-h commented Jan 24, 2019

Copy link
Copy Markdown
Author

Not sure if either overflow or underflow is the most appropriate term here, I just went with the same name as the previous request. What happens is the serialization output from igbinary_serialize doesn't seem to contain any curly brackets so the condition for end might not be met.
For example, while the output of

serialize(new \DS\Map)

would be

C:6:"Ds\Map":0:{}"

the output of

igbinary_serialize(new \DS\Map)

would be

"���Ds\Map�"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants