Skip to content

ext/spl: Fix ArrayObject unserialize validation for invalid iterator classes#22090

Open
arshidkv12 wants to merge 2 commits into
php:masterfrom
arshidkv12:GH-22047
Open

ext/spl: Fix ArrayObject unserialize validation for invalid iterator classes#22090
arshidkv12 wants to merge 2 commits into
php:masterfrom
arshidkv12:GH-22047

Conversation

@arshidkv12
Copy link
Copy Markdown
Contributor

Comment thread ext/spl/spl_array.c Outdated

if (!instanceof_function(ce, zend_ce_iterator)) {
if (!instanceof_function(ce, spl_ce_ArrayIterator) &&
!instanceof_function(ce, spl_ce_RecursiveArrayIterator)) {
Copy link
Copy Markdown
Member

@devnexen devnexen May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

note: RecursiveArrayIterator extends ArrayIterator (look at module initialisation).

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you

Comment thread ext/spl/spl_array.c
}

if (!instanceof_function(ce, zend_ce_iterator)) {
if (!instanceof_function(ce, spl_ce_ArrayIterator)) {
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is more restrictive than the current code. But then I have no idea if it even makes sens to attempt to use any iterator. But in this case the error message needs to be fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

The unserialize function with ArrayObject leads to NULL pointer dereference

3 participants