php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #19223 unserializing objects crashes apache
Submitted: 2002-09-04 02:22 UTC Modified: 2002-10-17 22:48 UTC
Votes:1
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: tysonlt at _S_P_A_M_webmedia dot com dot au Assigned:
Status: Closed Package: Scripting Engine problem
PHP Version: 4CVS-2002-09-04 OS: Redhat 7.2
Private report: No CVE-ID: None
View Developer Edit
 [2002-09-04 02:22 UTC] tysonlt at _S_P_A_M_webmedia dot com dot au 
Hi, 

I'm actually using 200209032100.

this script will cause apache to segfault:

<?php
    class TestClass { }

    $str = serialize(new TestClass());
    echo $str;
    unserialize($str);
?>

Comment out the unserialize() line and it works fine.

Here is the backtrace:

#0  0x401c42a8 in __clz_tab () from /lib/i686/libc.so.6
#1  0x40329b6a in _object_and_properties_init (arg=0x407844e4,
    class_type=0x811f7b4, properties=0x0)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/Zend/zend_API.c:603
#2  0x40329ba7 in _object_init_ex (arg=0x407844e4, class_type=0x811f7b4)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/Zend/zend_API.c:610
#3  0x402c84d5 in php_var_unserialize (rval=0xbfffdb74, p=0xbfffdb54,
    max=0x40784630 "", var_hash=0xbfffdb58)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/ext/standard/var_unserializer.c:192
#4  0x402c0fdd in zif_unserialize (ht=1, return_value=0x407844e4,
    this_ptr=0x0, return_value_used=0)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/ext/standard/var.c:667
#5  0x4033d231 in execute (op_array=0x40783fb4)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/Zend/zend_execute.c:2103
#6  0x40328817 in zend_execute_scripts (type=8, retval=0x0, file_count=3)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/Zend/zend.c:833
#7  0x4030319d in php_execute_script (primary_file=0xbffff5c0)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/main/main.c:1380
#8  0x40344102 in apache_php_module_main (r=0x8124d34, display_source_mode=0)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/sapi/apache/sapi_apache.c:55
#9  0x40344bf2 in send_php (r=0x8124d34, display_source_mode=0, filename=0x0)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/sapi/apache/mod_php4.c:550
#10 0x40344c56 in send_parsed_php (r=0x8124d34)
    at /usr/local/src/php-4.3.0-dev-zend2-alpha2/sapi/apache/mod_php4.c:565
#11 0x0806a87f in ap_invoke_handler () at eval.c:41
#12 0x0807f3e3 in process_request_internal () at eval.c:41
#13 0x0807f444 in ap_process_request () at eval.c:41
#14 0x0807644d in child_main () at eval.c:41
#15 0x080765f8 in make_child () at eval.c:41
#16 0x0807676c in startup_children () at eval.c:41
#17 0x08076de4 in standalone_main () at eval.c:41
#18 0x08077647 in main () at eval.c:41
#19 0x400b2627 in __libc_start_main (main=0x80772a0 <main>, argc=2,
    ubp_av=0xbffffa14, init=0x804e644 <_init>, fini=0x8094e00 <_fini>,
    rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbffffa0c)
    at ../sysdeps/generic/libc-start.c:129

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2002-09-04 06:27 UTC] sniper@php.net 
reclassified as ZE2 problem since this does not happen
with PHP 4.3.0-dev (with ZE1)
 [2002-10-17 22:48 UTC] iliaa@php.net 
This bug has been fixed in CVS.

In case this was a PHP problem, snapshots of the sources are packaged
every three hours; this change will be in the next snapshot. You can
grab the snapshot at http://snaps.php.net/.
 
In case this was a documentation problem, the fix will show up soon at
http://www.php.net/manual/.

In case this was a PHP.net website problem, the change will show
up on the PHP.net site and on the mirror sites in short time.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Fri Dec 12 09:00:01 2025 UTC