CVE-2016-10161: Out-of-bounds Read (CWE-125)
value: The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) via crafted serialized data that is mishandled in a finish_nested_data call.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2017-01-24T21:59Z
Repository: https://github.com/php/php-src
Language: Other
Files changed: ext/standard/tests/serialize/bug73825.phpt, ext/standard/var_unserializer.c, ext/standard/var_unserializer.re
Commit date: 2016-12-30 16:59:46 -0800
Commit message: Fix bug #73825 - Heap out of bounds read on unserialize in finish_nested_data()

Diff: diff --git a/ext/standard/tests/serialize/bug73825.phpt b/ext/standard/tests/serialize/bug73825.phpt
new file mode 100644
index 00000000000..adbfca1bbb1
--- /dev/null
+++ b/ext/standard/tests/serialize/bug73825.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #73825 Heap out of bounds read on unserialize in finish_nested_data()
+--FILE--
+<?php
+$obj = unserialize('O:8:"00000000":');
+var_dump($obj);
+?>
+--EXPECTF--
+Warning: Bad unserialize data in %sbug73825.php on line %d
+
+Notice: unserialize(): Error at offset 13 of 15 bytes in %sbug73825.php on line %d
+bool(false)
diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 549149267eb..efb0942b05d 100644
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -403,21 +403,26 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 
 static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
 	long elements;
 
+	if( *p >= max - 2) {
+		zend_error(E_WARNING, "Bad unserialize data");
+		return -1;
+	}
+
 	elements = parse_iv2((*p) + 2, p);
 
 	(*p) += 2;
 
 	if (ce->serialize == NULL) {
 		object_init_ex(*rval, ce);
 	} else {
 		/* If this class implements Serializable, it should not land here but in object_custom(). The passed string
 		obviously doesn't descend from the regular serializer. */
 		zend_error(E_WARNING, "Erroneous data format for unserializing '%s'", ce->name);
-		return 0;
+		return -1;
 	}
 
 	return elements;
 }
 
@@ -490,11 +495,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	start = cursor;
 
 
 
 
-#line 496 "ext/standard/var_unserializer.c"
+#line 501 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
 		  0,   0,   0,   0,   0,   0,   0,   0, 
 		  0,   0,   0,   0,   0,   0,   0,   0, 
@@ -550,13 +555,13 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	}
 yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 861 "ext/standard/var_unserializer.re"
+#line 875 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 558 "ext/standard/var_unserializer.c"
+#line 563 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
 	goto yy3;
 yy5:
@@ -595,17 +600,17 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy17;
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 855 "ext/standard/var_unserializer.re"
+#line 869 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 607 "ext/standard/var_unserializer.c"
+#line 612 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
 yy17:
 	yych = *++YYCURSOR;
@@ -632,11 +637,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	if (yych <= '/') goto yy18;
 	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 708 "ext/standard/var_unserializer.re"
+#line 717 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
 	char *class_name;
 	zend_class_entry *ce;
@@ -772,18 +777,23 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 		return ret;
 	}
 
 	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
 
+	if (elements < 0) {
+	   efree(class_name);
+	   return 0;
+	}
+
 	if (incomplete_class) {
 		php_store_class_name(*rval, class_name, len2);
 	}
 	efree(class_name);
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 785 "ext/standard/var_unserializer.c"
+#line 795 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
 		if (yych != '+') goto yy18;
 	} else {
@@ -804,20 +814,24 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	if (yych <= '9') goto yy27;
 	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 699 "ext/standard/var_unserializer.re"
+#line 704 "ext/standard/var_unserializer.re"
 	{
+	long elements;
     if (!var_hash) return 0;
 
 	INIT_PZVAL(*rval);
 
-	return object_common2(UNSERIALIZE_PASSTHRU,
-			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
+	if (elements < 0) {
+		return 0;
+	}
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 819 "ext/standard/var_unserializer.c"
+#line 833 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
 	if (yych <= '/') goto yy18;
 	if (yych <= '9') goto yy34;
@@ -834,11 +848,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	if (yych <= '9') goto yy34;
 	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 678 "ext/standard/var_unserializer.re"
+#line 683 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
 	*p = YYCURSOR;
     if (!var_hash) return 0;
@@ -855,11 +869,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 		return 0;
 	}
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 861 "ext/standard/var_unserializer.c"
+#line 875 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
 	if (yych <= '/') goto yy18;
 	if (yych <= '9') goto yy41;
@@ -876,11 +890,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	if (yych <= '9') goto yy41;
 	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 643 "ext/standard/var_unserializer.re"
+#line 648 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
 
 	len = parse_uiv(start + 2);
@@ -911,11 +925,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 
 	INIT_PZVAL(*rval);
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 917 "ext/standard/var_unserializer.c"
+#line 931 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
 	if (yych <= '/') goto yy18;
 	if (yych <= '9') goto yy48;
@@ -932,11 +946,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	if (yych <= '9') goto yy48;
 	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 610 "ext/standard/var_unserializer.re"
+#line 615 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
 
 	len = parse_uiv(start + 2);
@@ -965,11 +979,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 
 	INIT_PZVAL(*rval);
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 971 "ext/standard/var_unserializer.c"
+#line 985 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
 		if (yych <= ',') {
 			if (yych == '+') goto yy57;
@@ -1053,21 +1067,21 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 			goto yy18;
 		}
 	}
 yy63:
 	++YYCURSOR;
-#line 600 "ext/standard/var_unserializer.re"
+#line 605 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
 #endif
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1069 "ext/standard/var_unserializer.c"
+#line 1083 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
 		if (yych != '+') goto yy18;
 	} else {
@@ -1122,11 +1136,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	if (yych != 'F') goto yy18;
 yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 585 "ext/standard/var_unserializer.re"
+#line 590 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 
 	if (!strncmp(start + 2, "NAN", 3)) {
@@ -1137,11 +1151,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 		ZVAL_DOUBLE(*rval, -php_get_inf());
 	}
 
 	return 1;
 }
-#line 1143 "ext/standard/var_unserializer.c"
+#line 1157 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
 	goto yy18;
 yy77:
@@ -1164,11 +1178,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 558 "ext/standard/var_unserializer.re"
+#line 563 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 	int digits = YYCURSOR - start - 3;
 
 	if (start[2] == '-' || start[2] == '+') {
@@ -1191,36 +1205,36 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1197 "ext/standard/var_unserializer.c"
+#line 1211 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych >= '2') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 551 "ext/standard/var_unserializer.re"
+#line 556 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1212 "ext/standard/var_unserializer.c"
+#line 1226 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 544 "ext/standard/var_unserializer.re"
+#line 549 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1222 "ext/standard/var_unserializer.c"
+#line 1236 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
 		if (yych != '+') goto yy18;
 	} else {
@@ -1239,11 +1253,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 521 "ext/standard/var_unserializer.re"
+#line 526 "ext/standard/var_unserializer.re"
 	{
 	long id;
 
  	*p = YYCURSOR;
 	if (!var_hash) return 0;
@@ -1262,11 +1276,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	Z_ADDREF_PP(rval);
 	Z_UNSET_ISREF_PP(rval);
 
 	return 1;
 }
-#line 1268 "ext/standard/var_unserializer.c"
+#line 1282 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
 		if (yych != '+') goto yy18;
 	} else {
@@ -1285,11 +1299,11 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	yych = *YYCURSOR;
 	if (yych <= '/') goto yy18;
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 500 "ext/standard/var_unserializer.re"
+#line 505 "ext/standard/var_unserializer.re"
 	{
 	long id;
 
  	*p = YYCURSOR;
 	if (!var_hash) return 0;
@@ -1306,12 +1320,12 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	Z_ADDREF_PP(rval);
 	Z_SET_ISREF_PP(rval);
 
 	return 1;
 }
-#line 1312 "ext/standard/var_unserializer.c"
+#line 1326 "ext/standard/var_unserializer.c"
 }
-#line 863 "ext/standard/var_unserializer.re"
+#line 877 "ext/standard/var_unserializer.re"
 
 
 	return 0;
 }
diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index ce84bf5eb40..4cdf3137350 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -407,21 +407,26 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 
 static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
 	long elements;
 
+	if( *p >= max - 2) {
+		zend_error(E_WARNING, "Bad unserialize data");
+		return -1;
+	}
+
 	elements = parse_iv2((*p) + 2, p);
 
 	(*p) += 2;
 
 	if (ce->serialize == NULL) {
 		object_init_ex(*rval, ce);
 	} else {
 		/* If this class implements Serializable, it should not land here but in object_custom(). The passed string
 		obviously doesn't descend from the regular serializer. */
 		zend_error(E_WARNING, "Erroneous data format for unserializing '%s'", ce->name);
-		return 0;
+		return -1;
 	}
 
 	return elements;
 }
 
@@ -695,16 +700,20 @@ use_double:
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
 
 "o:" iv ":" ["] {
+	long elements;
     if (!var_hash) return 0;
 
 	INIT_PZVAL(*rval);
 
-	return object_common2(UNSERIALIZE_PASSTHRU,
-			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
+	if (elements < 0) {
+		return 0;
+	}
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
 
 object ":" uiv ":" ["]	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -842,10 +851,15 @@ object ":" uiv ":" ["]	{
 		return ret;
 	}
 
 	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
 
+	if (elements < 0) {
+	   efree(class_name);
+	   return 0;
+	}
+
 	if (incomplete_class) {
 		php_store_class_name(*rval, class_name, len2);
 	}
 	efree(class_name);
 

Vulnerable code: 		return 0;
#line 496 "ext/standard/var_unserializer.c"
#line 861 "ext/standard/var_unserializer.re"
#line 558 "ext/standard/var_unserializer.c"
#line 855 "ext/standard/var_unserializer.re"
#line 607 "ext/standard/var_unserializer.c"
#line 708 "ext/standard/var_unserializer.re"
#line 785 "ext/standard/var_unserializer.c"
#line 699 "ext/standard/var_unserializer.re"
	return object_common2(UNSERIALIZE_PASSTHRU,
			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
#line 819 "ext/standard/var_unserializer.c"
#line 678 "ext/standard/var_unserializer.re"
#line 861 "ext/standard/var_unserializer.c"
#line 643 "ext/standard/var_unserializer.re"
#line 917 "ext/standard/var_unserializer.c"
#line 610 "ext/standard/var_unserializer.re"
#line 971 "ext/standard/var_unserializer.c"
#line 600 "ext/standard/var_unserializer.re"
#line 1069 "ext/standard/var_unserializer.c"
#line 585 "ext/standard/var_unserializer.re"
#line 1143 "ext/standard/var_unserializer.c"
#line 558 "ext/standard/var_unserializer.re"
#line 1197 "ext/standard/var_unserializer.c"
#line 551 "ext/standard/var_unserializer.re"
#line 1212 "ext/standard/var_unserializer.c"
#line 544 "ext/standard/var_unserializer.re"
#line 1222 "ext/standard/var_unserializer.c"
#line 521 "ext/standard/var_unserializer.re"
#line 1268 "ext/standard/var_unserializer.c"
#line 500 "ext/standard/var_unserializer.re"
#line 1312 "ext/standard/var_unserializer.c"
#line 863 "ext/standard/var_unserializer.re"
		return 0;
	return object_common2(UNSERIALIZE_PASSTHRU,
			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
Fixed code: --TEST--
Bug #73825 Heap out of bounds read on unserialize in finish_nested_data()
--FILE--
<?php
$obj = unserialize('O:8:"00000000":');
var_dump($obj);
?>
--EXPECTF--
Warning: Bad unserialize data in %sbug73825.php on line %d

Notice: unserialize(): Error at offset 13 of 15 bytes in %sbug73825.php on line %d
bool(false)
	if( *p >= max - 2) {
		zend_error(E_WARNING, "Bad unserialize data");
		return -1;
	}

		return -1;
#line 501 "ext/standard/var_unserializer.c"
#line 875 "ext/standard/var_unserializer.re"
#line 563 "ext/standard/var_unserializer.c"
#line 869 "ext/standard/var_unserializer.re"
#line 612 "ext/standard/var_unserializer.c"
#line 717 "ext/standard/var_unserializer.re"
	if (elements < 0) {
	   efree(class_name);
	   return 0;
	}

#line 795 "ext/standard/var_unserializer.c"
#line 704 "ext/standard/var_unserializer.re"
	long elements;
	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
	if (elements < 0) {
		return 0;
	}
	return object_common2(UNSERIALIZE_PASSTHRU, elements);
#line 833 "ext/standard/var_unserializer.c"
#line 683 "ext/standard/var_unserializer.re"
#line 875 "ext/standard/var_unserializer.c"
#line 648 "ext/standard/var_unserializer.re"
#line 931 "ext/standard/var_unserializer.c"
#line 615 "ext/standard/var_unserializer.re"
#line 985 "ext/standard/var_unserializer.c"
#line 605 "ext/standard/var_unserializer.re"
#line 1083 "ext/standard/var_unserializer.c"
#line 590 "ext/standard/var_unserializer.re"
#line 1157 "ext/standard/var_unserializer.c"
#line 563 "ext/standard/var_unserializer.re"
#line 1211 "ext/standard/var_unserializer.c"
#line 556 "ext/standard/var_unserializer.re"
#line 1226 "ext/standard/var_unserializer.c"
#line 549 "ext/standard/var_unserializer.re"
#line 1236 "ext/standard/var_unserializer.c"
#line 526 "ext/standard/var_unserializer.re"
#line 1282 "ext/standard/var_unserializer.c"
#line 505 "ext/standard/var_unserializer.re"
#line 1326 "ext/standard/var_unserializer.c"
#line 877 "ext/standard/var_unserializer.re"
	if( *p >= max - 2) {
		zend_error(E_WARNING, "Bad unserialize data");
		return -1;
	}

		return -1;
	long elements;
	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
	if (elements < 0) {
		return 0;
	}
	return object_common2(UNSERIALIZE_PASSTHRU, elements);
	if (elements < 0) {
	   efree(class_name);
	   return 0;
	}