php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #78409 Segfault when creating instance of ArrayIterator without constructor
Submitted: 2019-08-13 17:00 UTC Modified: 2019-08-15 08:35 UTC
From: nicolas dot grekas+php at gmail dot com Assigned:
Status: Closed Package: Reproducible crash
PHP Version: 7.4.0beta2 OS:
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: nicolas dot grekas+php at gmail dot com
New email:
PHP Version: OS:

 

 [2019-08-13 17:00 UTC] nicolas dot grekas+php at gmail dot com 
Description:
------------
This is related to the new serialization mechanism of PHP 7.4.
I don't have a better reproducer because when I try to isolate the crash, it works...
Here is my reproducer, sorry I don't have a better one for now:
Clone https://github.com/nicolas-grekas/symfony
checkout branch "ve-php74"

Then run
./phpunit src/Symfony/Component/VarExporter/ --do-not-cache-result --filter testExport#6

boom

What the code does is that it:
- uses newInstanceWithoutConstructor to create an ArrayIterator
- clones that instance
- calls __unserialize on the clone instance with a valid payload

The crash happens after these step, when e.g. calling print_r() on the object.
When done "manually", it works. But in the context of the test case, it segfaults.

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2019-08-15 08:35 UTC] nikic@php.net
-Status: Open +Status: Analyzed
 [2019-08-15 08:35 UTC] nikic@php.net 
I believe the root cause here is this:

$a = new ArrayObject;
$u = [
    0,
    [],
    [],
];
$a->__unserialize($u);
var_dump($u);

array(3) {
  [0]=>
  int(0)
  [1]=>
  NULL        <-- changed to NULL
  [2]=>
  array(0) {
  }
}
 [2019-08-15 08:40 UTC] nikic@php.net 
Automatic comment on behalf of nikita.ppv@gmail.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=34885408db9e16c48e8c25195c39e0ef758faaaa
Log: Fixed bug #78409
 [2019-08-15 08:40 UTC] nikic@php.net
-Status: Analyzed +Status: Closed
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved. 		Last updated: Thu Nov 21 12:01:29 2024 UTC