bug #45610 [HttpKernel] Guard against bad profile data (nicolas-grekas)

nicolas-grekas · nicolas-grekas · commit 6ef994c981c8 · 2022-03-02T13:37:08.000+01:00
This PR was merged into the 4.4 branch. Discussion ---------- [HttpKernel] Guard against bad profile data | Q | A | ------------- | --- | Branch? | 4.4 | Bug fix? | yes | New feature? | no | Deprecations? | no | Tickets | Fix #45606 | License | MIT | Doc PR | - Commits ------- f4a2089 [HttpKernel] Guard against bad profile data
diff --git a/src/Symfony/Component/HttpKernel/Profiler/FileProfilerStorage.php b/src/Symfony/Component/HttpKernel/Profiler/FileProfilerStorage.php
@@ -123,7 +123,11 @@ public function read($token): ?Profile
             $file = 'compress.zlib://'.$file;
         }
 
-        return $this->createProfileFromData($token, unserialize(file_get_contents($file)));
+        if (!$data = unserialize(file_get_contents($file))) {
+            return null;
+        }
+
+        return $this->createProfileFromData($token, $data);
     }
 
     /**
@@ -297,7 +301,11 @@ protected function createProfileFromData($token, $data, $parent = null)
                 $file = 'compress.zlib://'.$file;
             }
 
-            $profile->addChild($this->createProfileFromData($token, unserialize(file_get_contents($file)), $profile));
+            if (!$childData = unserialize(file_get_contents($file))) {
+                continue;
+            }
+
+            $profile->addChild($this->createProfileFromData($token, $childData, $profile));
         }
 
         return $profile;

Original file line number	Diff line number	Diff line change
`@@ -123,7 +123,11 @@ public function read($token): ?Profile`
`123`	`123`	`$file = 'compress.zlib://'.$file;`
`124`	`124`	`}`
`125`	`125`
`126`		`- return $this->createProfileFromData($token, unserialize(file_get_contents($file)));`
	`126`	`+ if (!$data = unserialize(file_get_contents($file))) {`
	`127`	`+ return null;`
	`128`	`+ }`
	`129`	`+`
	`130`	`+ return $this->createProfileFromData($token, $data);`
`127`	`131`	`}`
`128`	`132`
`129`	`133`	`/**`
`@@ -297,7 +301,11 @@ protected function createProfileFromData($token, $data, $parent = null)`
`297`	`301`	`$file = 'compress.zlib://'.$file;`
`298`	`302`	`}`
`299`	`303`
`300`		`- $profile->addChild($this->createProfileFromData($token, unserialize(file_get_contents($file)), $profile));`
	`304`	`+ if (!$childData = unserialize(file_get_contents($file))) {`
	`305`	`+ continue;`
	`306`	`+ }`
	`307`	`+`
	`308`	`+ $profile->addChild($this->createProfileFromData($token, $childData, $profile));`
`301`	`309`	`}`
`302`	`310`
`303`	`311`	`return $profile;`