CVE-2020-1900

Pre-reserve object dynamic properties when unserializing
facebook · Jun 30, 2020 · c1c4bb0 · c1c4bb0
1 parent 1107228
commit c1c4bb0
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/hphp/runtime/base/object-data.cpp b/hphp/runtime/base/object-data.cpp
@@ -342,6 +342,11 @@ Array& ObjectData::reserveProperties(int numDynamic /* = 2 */) {
     return dynPropArray();
   }
 
+  auto const allocsz = MixedArray::computeAllocBytesFromMaxElms(numDynamic);
+  if (UNLIKELY(allocsz > kMaxSmallSize && tl_heap->preAllocOOM(allocsz))) {
+    check_non_safepoint_surprise();
+  }
+
   return setDynPropArray(
       Array::attach(MixedArray::MakeReserveMixed(numDynamic))
   );

diff --git a/hphp/runtime/base/variable-unserializer.cpp b/hphp/runtime/base/variable-unserializer.cpp
@@ -552,6 +552,7 @@ void VariableUnserializer::unserializeProp(ObjectData* obj,
     // Unserialize as a dynamic property. If this is the first, we need to
     // pre-allocate space in the array to ensure the elements don't move during
     // unserialization.
+    obj->reserveDynProps(nProp);
     t = obj->makeDynProp(realKey.get());
   } else {
     // We'll check if this doesn't violate the type-hint once we're done