Bug #70767 [Ana]: crash after script execution

Edit report at https://bugs.php.net/bug.php?id=70767&edit=1 ID: 70767 Updated by: stas@php.net Reported by: liska at avast dot com Summary: crash after script execution Status: Analyzed Type: Bug Package: Reproducible crash Operating System: windows 7 64-bit -PHP Version: 7.0.0RC5 +PHP Version: 7.0.1 -Assigned To: stas +Assigned To: Block user comment: N Private report: N New Comment: Still reproduces on 7.x, but not sure what is the cause yet. The references are allowed in serialized objects, but it's true you can mess things up if you do them maliciously. Not sure yet how to fix it. Previous Comments: ------------------------------------------------------------------------ [2015-10-23 23:18:46] ryat@php.net @laruence reference in Serializable object is allowed. and 5.x branchs is right. you can see these: https://3v4l.org/HTQUL https://3v4l.org/JvrVs you script has triggered UAF/memory corruption in php7.x, so the result is strange. ------------------------------------------------------------------------ [2015-10-23 09:23:27] laruence@php.net @stas what do you think ? since you have been working on serialize issues for some times ------------------------------------------------------------------------ [2015-10-23 08:49:23] laruence@php.net should be: https://3v4l.org/GcebX ------------------------------------------------------------------------ [2015-10-23 08:48:24] laruence@php.net maybe the 5.6 behaviors wrongly , https://3v4l.org/new reference to a internal (external) object is not allowed. ------------------------------------------------------------------------ [2015-10-23 01:22:11] ryat@php.net These security patches are not merged yet to master/7.0 http://news.php.net/php.internals/87998 ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=70767 -- Edit this bug report at https://bugs.php.net/bug.php?id=70767&edit=1