Skip to content

Commit 6d3695a

Browse files
committed
Deny serialization of finfo objects
The resulting objects were already unusable, make it error out earlier.
1 parent 70388cc commit 6d3695a

File tree

2 files changed

+6
-3
lines changed

2 files changed

+6
-3
lines changed

ext/fileinfo/fileinfo.c

+4-1
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
#include "fileinfo_arginfo.h"
3636
#include "fopen_wrappers.h" /* needed for is_url */
3737
#include "Zend/zend_exceptions.h"
38+
#include "Zend/zend_interfaces.h"
3839

3940
/* {{{ macros and type definitions */
4041
typedef struct _php_fileinfo {
@@ -132,8 +133,10 @@ PHP_MINIT_FUNCTION(finfo)
132133
{
133134
zend_class_entry _finfo_class_entry;
134135
INIT_CLASS_ENTRY(_finfo_class_entry, "finfo", class_finfo_methods);
135-
_finfo_class_entry.create_object = finfo_objects_new;
136136
finfo_class_entry = zend_register_internal_class(&_finfo_class_entry);
137+
finfo_class_entry->create_object = finfo_objects_new;
138+
finfo_class_entry->serialize = zend_class_serialize_deny;
139+
finfo_class_entry->unserialize = zend_class_unserialize_deny;
137140

138141
/* copy the standard object handlers to you handler table */
139142
memcpy(&finfo_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));

ext/fileinfo/tests/clone_serialize.phpt

+2-2
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,12 @@ try {
1414
try {
1515
$finfo3 = unserialize(serialize($finfo));
1616
var_dump($finfo3->buffer("Test string"));
17-
} catch (Error $e) {
17+
} catch (Exception $e) {
1818
echo $e->getMessage(), "\n";
1919
}
2020

2121
?>
2222
--EXPECTF--
2323
string(%d) "%s"
2424
Trying to clone an uncloneable object of class finfo
25-
Invalid finfo object
25+
Serialization of 'finfo' is not allowed

0 commit comments

Comments
 (0)