File php-CVE-2016-9137.patch of Package php5.3636
Index: php-5.6.1/Zend/zend_API.c
===================================================================
--- php-5.6.1.orig/Zend/zend_API.c 2014-10-01 11:17:38.000000000 +0200
+++ php-5.6.1/Zend/zend_API.c 2016-11-08 09:59:09.535978910 +0100
@@ -3734,6 +3734,30 @@ ZEND_API void zend_update_property(zend_
}
/* }}} */
+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
+{
+ zval *property;
+ zend_class_entry *old_scope = EG(scope);
+
+ EG(scope) = scope;
+
+ if (!Z_OBJ_HT_P(object)->unset_property) {
+ const char *class_name;
+ zend_uint class_name_len;
+
+ zend_get_object_classname(object, &class_name, &class_name_len TSRMLS_CC);
+
+ zend_error(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, class_name);
+ }
+ MAKE_STD_ZVAL(property);
+ ZVAL_STRINGL(property, name, name_length, 1);
+ Z_OBJ_HT_P(object)->unset_property(object, property, 0 TSRMLS_CC);
+ zval_ptr_dtor(&property);
+
+ EG(scope) = old_scope;
+}
+/* }}} */
+
ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
{
zval *tmp;
Index: php-5.6.1/Zend/zend_API.h
===================================================================
--- php-5.6.1.orig/Zend/zend_API.h 2014-10-01 11:17:38.000000000 +0200
+++ php-5.6.1/Zend/zend_API.h 2016-11-08 09:59:09.535978910 +0100
@@ -330,6 +330,7 @@ ZEND_API void zend_update_property_long(
ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object, const char *name, int name_length, double value TSRMLS_DC);
ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value TSRMLS_DC);
ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value, int value_length TSRMLS_DC);
+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC);
ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, int name_length, zval *value TSRMLS_DC);
ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, int name_length TSRMLS_DC);
Index: php-5.6.1/ext/curl/curl_file.c
===================================================================
--- php-5.6.1.orig/ext/curl/curl_file.c 2014-10-01 11:17:38.000000000 +0200
+++ php-5.6.1/ext/curl/curl_file.c 2016-11-08 09:59:09.535978910 +0100
@@ -137,7 +137,10 @@ ZEND_METHOD(CURLFile, setPostFilename)
Unserialization handler */
ZEND_METHOD(CURLFile, __wakeup)
{
- zend_update_property_string(curl_CURLFile_class, getThis(), "name", sizeof("name")-1, "" TSRMLS_CC);
+ zval *_this = getThis();
+
+ zend_unset_property(curl_CURLFile_class, _this, "name", sizeof("name")-1 TSRMLS_CC);
+ zend_update_property_string(curl_CURLFile_class, _this, "name", sizeof("name")-1, "" TSRMLS_CC);
zend_throw_exception(NULL, "Unserialization of CURLFile instances is not allowed", 0 TSRMLS_CC);
}
/* }}} */