CVE-2020-1899

VariableUnserializer should only recognize type 'S' in APCSerialization mode
facebook · Jun 30, 2020 · 1107228 · 1107228
1 parent 1746dfb
commit 1107228
Show file tree

Hide file tree

Showing 3 changed files with 14 additions and 1 deletion.
diff --git a/hphp/runtime/base/variable-unserializer.cpp b/hphp/runtime/base/variable-unserializer.cpp
@@ -485,7 +485,7 @@ bool VariableUnserializer::matchString(folly::StringPiece str) {
   const char* p = m_buf;
   assertx(p <= m_end);
   int total = 0;
-  if (*p == 'S') {
+  if (*p == 'S' && type() == VariableUnserializer::Type::APCSerialize) {
     total = 2 + 8 + 1;
     if (p + total > m_end) return false;
     p++;

diff --git a/hphp/test/slow/serialization/no-apc-string-pointer.php b/hphp/test/slow/serialization/no-apc-string-pointer.php
@@ -0,0 +1,11 @@
+<?hh
+// Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved.
+
+class Foo {
+  public $name;
+}
+
+<<__EntryPoint>>
+function main() {
+  var_dump(unserialize("O:3:\"foo\":1:{S:\x00\x00\x00\x00\x00\x00\x00\x00;s:5:\"value\";}"));
+}
diff --git a/hphp/test/slow/serialization/no-apc-string-pointer.php.expectf b/hphp/test/slow/serialization/no-apc-string-pointer.php.expectf
@@ -0,0 +1,2 @@
+Notice: Unable to unserialize: [O:3:"foo":1:{S:]. Unknown type 'S'. in %s/no-apc-string-pointer.php on line 10
+bool(false)