CVE-2016-7411 (C, published 2016-09-17T21:59Z)
Description: value: ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an unserialize call that references a partially constructed object.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
Zend/zend_objects_API.c
ext/standard/tests/serialize/bug73052.phpt
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re
Commit message: Fix bug #73052 - Memory Corruption in During Deserialized-object Destruction


Vulnerable code:
			
	
	obj_bucket->bucket.obj.handlers = Z_OBJ_HT_P(zobject);;
#line 495 "ext/standard/var_unserializer.c"
#line 860 "ext/standard/var_unserializer.re"
#line 557 "ext/standard/var_unserializer.c"
#line 854 "ext/standard/var_unserializer.re"
#line 606 "ext/standard/var_unserializer.c"
#line 707 "ext/standard/var_unserializer.re"
#line 784 "ext/standard/var_unserializer.c"
#line 698 "ext/standard/var_unserializer.re"
#line 818 "ext/standard/var_unserializer.c"
#line 677 "ext/standard/var_unserializer.re"
#line 860 "ext/standard/var_unserializer.c"
#line 642 "ext/standard/var_unserializer.re"
#line 916 "ext/standard/var_unserializer.c"
#line 609 "ext/standard/var_unserializer.re"
#line 970 "ext/standard/var_unserializer.c"
#line 599 "ext/standard/var_unserializer.re"
#line 1068 "ext/standard/var_unserializer.c"
#line 584 "ext/standard/var_unserializer.re"
#line 1142 "ext/standard/var_unserializer.c"
#line 557 "ext/standard/var_unserializer.re"
#line 1196 "ext/standard/var_unserializer.c"
#line 550 "ext/standard/var_unserializer.re"
#line 1211 "ext/standard/var_unserializer.c"
#line 543 "ext/standard/var_unserializer.re"
#line 1221 "ext/standard/var_unserializer.c"
#line 520 "ext/standard/var_unserializer.re"
#line 1267 "ext/standard/var_unserializer.c"
#line 499 "ext/standard/var_unserializer.re"
#line 1311 "ext/standard/var_unserializer.c"
#line 862 "ext/standard/var_unserializer.re"

Fixed code:


	obj_bucket->bucket.obj.handlers = Z_OBJ_HT_P(zobject);
--TEST--
Bug #73052: Memory Corruption in During Deserialized-object Destruction
--FILE--
<?php

class obj {
    var $ryat;
    public function __destruct() {
        $this->ryat = null;
    }
}

$poc = 'O:3:"obj":1:{';
var_dump(unserialize($poc));
?>
--EXPECTF--
Notice: unserialize(): Error at offset 13 of 13 bytes in %sbug73052.php on line %d
bool(false)
	       zend_object_store_ctor_failed(*rval TSRMLS_CC);
#line 496 "ext/standard/var_unserializer.c"
#line 861 "ext/standard/var_unserializer.re"
#line 558 "ext/standard/var_unserializer.c"
#line 855 "ext/standard/var_unserializer.re"
#line 607 "ext/standard/var_unserializer.c"
#line 708 "ext/standard/var_unserializer.re"
#line 785 "ext/standard/var_unserializer.c"
#line 699 "ext/standard/var_unserializer.re"
#line 819 "ext/standard/var_unserializer.c"
#line 678 "ext/standard/var_unserializer.re"
#line 861 "ext/standard/var_unserializer.c"
#line 643 "ext/standard/var_unserializer.re"
#line 917 "ext/standard/var_unserializer.c"
#line 610 "ext/standard/var_unserializer.re"
#line 971 "ext/standard/var_unserializer.c"
#line 600 "ext/standard/var_unserializer.re"
#line 1069 "ext/standard/var_unserializer.c"
#line 585 "ext/standard/var_unserializer.re"
#line 1143 "ext/standard/var_unserializer.c"
#line 558 "ext/standard/var_unserializer.re"
#line 1197 "ext/standard/var_unserializer.c"
#line 551 "ext/standard/var_unserializer.re"
#line 1212 "ext/standard/var_unserializer.c"
#line 544 "ext/standard/var_unserializer.re"
#line 1222 "ext/standard/var_unserializer.c"
#line 521 "ext/standard/var_unserializer.re"
#line 1268 "ext/standard/var_unserializer.c"
#line 500 "ext/standard/var_unserializer.re"
#line 1312 "ext/standard/var_unserializer.c"
#line 863 "ext/standard/var_unserializer.re"
	       zend_object_store_ctor_failed(*rval TSRMLS_CC);