|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #80411 References to null-serialized object break serialize()
Submitted: 2020-11-24 16:54 UTC Modified: 2020-11-25 16:13 UTC
Avg. Score:3.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:1 (100.0%)
Same OS:0 (0.0%)
From: whaanstra at eljakim dot nl Assigned:
Status: Closed Package: *General Issues
PHP Version: 7.4.12 OS:
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Bug Type:
From: whaanstra at eljakim dot nl
New email:
PHP Version: OS:


 [2020-11-24 16:54 UTC] whaanstra at eljakim dot nl
The reference to the UnSerializable object is serialized as a null, instead of as a reference. In addition, the serializer still sees it as a reference, causing the count of reference-able objects to be off. In my test script, $recovered[3] references $recovered[1] instead of $recovered[2].

This might be related to, which also involved an empty serialize() method, and was fixed in the same version this was introduced, namely 7.3.4.

Version comparison:

Test script:
class UnSerializable implements Serializable
  public function serialize() {}
  public function unserialize($serialized) {}

$unser = new UnSerializable();
$arr = [$unser];
$arr[] = &$arr[0];
$arr[] = 'endcap';
$arr[] = &$arr[2];

$data = serialize($arr);
echo $data . PHP_EOL;
$recovered = unserialize($data);

Expected result:
array (
  0 => NULL,
  1 => NULL,
  2 => 'endcap',
  3 => 'endcap',

Actual result:
array (
  0 => NULL,
  1 => NULL,
  2 => 'endcap',
  3 => NULL,


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2020-11-25 16:13 UTC]
-Status: Open +Status: Verified
 [2020-11-25 16:25 UTC]
Automatic comment on behalf of
Log: Fixed bug #80411
 [2020-11-25 16:25 UTC]
-Status: Verified +Status: Closed
 [2020-11-27 14:53 UTC] whaanstra at eljakim dot nl
This fix is not quite the same behaviour as pre-7.3.4, since the second element of the reconstructed array is no longer a reference to the first element.
PHP Copyright © 2001-2023 The PHP Group
All rights reserved.
Last updated: Tue Jun 06 17:03:39 2023 UTC