php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #71864 php serialize function cycle lead to stack exhausted
Submitted: 2016-03-21 03:39 UTC Modified: 2016-03-21 05:13 UTC
From: niubl at knownsec dot com Assigned:
Status: Not a bug Package: Scripting Engine problem
PHP Version: 7.0.5RC1 OS: linux kali
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: niubl at knownsec dot com
New email:
PHP Version: OS:

 

 [2016-03-21 03:39 UTC] niubl at knownsec dot com
Description:
------------
when php serialize a user define serialize class and this class's serialize function serialize its clone object, it lead to a cycle and stack exhausted

Test script:
---------------
<?php

class A implements Serializable
{

    public function serialize()
    {
        return serialize(clone $this);
    }

    public function unserialize($data)
    {

    }
}

serialize(new A());

?>


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2016-03-21 05:13 UTC] requinix@php.net
-Status: Open +Status: Not a bug
 [2016-03-21 05:13 UTC] requinix@php.net
PHP does not protect from stack smashing.
 
PHP Copyright © 2001-2026 The PHP Group
All rights reserved.
Last updated: Wed Oct 07 15:00:01 2026 UTC