Skip to content

Conversation

rado-h
Copy link

@rado-h rado-h commented Jan 24, 2019

The same fix from #111 applied for the deserialization of maps.

@rtheunissen rtheunissen merged commit 3096126 into php-ds:master Jan 24, 2019
@rtheunissen
Copy link
Member

Thank you. Could you please explain to me how this allows for buffer overflow?

@rado-h
Copy link
Author

rado-h commented Jan 24, 2019

Not sure if either overflow or underflow is the most appropriate term here, I just went with the same name as the previous request. What happens is the serialization output from igbinary_serialize doesn't seem to contain any curly brackets so the condition for end might not be met.
For example, while the output of

serialize(new \DS\Map)

would be

C:6:"Ds\Map":0:{}"

the output of

igbinary_serialize(new \DS\Map)

would be

"���Ds\Map�"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants