CVE-2018-15503 (C, published 2018-08-18T02:29Z)
Description: value: The unpack implementation in Swoole version 4.0.4 lacks correct size checks in the deserialization process. An attacker can craft a serialized object to exploit this vulnerability and cause a SEGV.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/swoole/swoole-src
Files changed:
swoole_serialize.c
Commit message: add buffer end check

Vulnerable code:
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
        /* no break */
                    ((SBucketType*) (buffer->buffer + p))->data_type = IS_NULL;//reset type null
    
    if (flag == UNSERIALIZE_OBJECT_TO_STDCLASS) 
    } 
    else 
    zval *data,*d;
    
//            zend_hash_update(Z_OBJPROP_P(return_value),key,data);
//            zend_update_property(ce, return_value, ZSTR_VAL(key), ZSTR_LEN(key), data);

                  php_error_docref(NULL TSRMLS_CC, E_NOTICE, "detect the error eof");
                  return SW_FALSE;
                  php_error_docref(NULL TSRMLS_CC, E_NOTICE, "detect the error eof");
                  return SW_FALSE;

Fixed code:
#define CHECK_STEP if(buffer>unseri_buffer_end){ php_error_docref(NULL TSRMLS_CC, E_ERROR, "illegal unserialize data"); return NULL;}
char *unseri_buffer_end = NULL;

            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
            /* no break */
    CHECK_STEP;
                CHECK_STEP;
                CHECK_STEP;
    CHECK_STEP;
                    ((SBucketType*) (buffer->buffer + p))->data_type = IS_NULL; //reset type null


    CHECK_STEP;
    if (flag == UNSERIALIZE_OBJECT_TO_STDCLASS)
    }
    else
    CHECK_STEP;
    zval *data, *d;
            //            zend_hash_update(Z_OBJPROP_P(return_value),key,data);
            //            zend_update_property(ce, return_value, ZSTR_VAL(key), ZSTR_LEN(key), data);
    CHECK_STEP;
    unseri_buffer_end = buffer + len;
                php_error_docref(NULL TSRMLS_CC, E_NOTICE, "detect the error eof");
                return SW_FALSE;
                php_error_docref(NULL TSRMLS_CC, E_NOTICE, "detect the error eof");
                return SW_FALSE;