Bug #71864 [Opn->Nab]: php serialize function cycle lead to stack exhausted
| From: | requinix@php.net | Date: | Mon, 21 Mar 2016 05:13:40 +0000 |
| Subject: | Bug #71864 [Opn->Nab]: php serialize function cycle lead to stack exhausted | ||
| References: | 1 | Groups: | php.bugs |
| Request: | Send a blank email to php-bugs+get-199979@lists.php.net to get a copy of this message | ||
Edit report at https://bugs.php.net/bug.php?id=71864&edit=1
ID: 71864
Updated by: requinix@php.net
Reported by: niubl at knownsec dot com
Summary: php serialize function cycle lead to stack exhausted
-Status: Open
+Status: Not a bug
Type: Bug
Package: Scripting Engine problem
Operating System: linux kali
PHP Version: 7.0.5RC1
Block user comment: N
Private report: N
New Comment:
PHP does not protect from stack smashing.
Previous Comments:
------------------------------------------------------------------------
[2016-03-21 03:39:40] niubl at knownsec dot com
Description:
------------
when php serialize a user define serialize class and this class's serialize function serialize
its clone object, it lead to a cycle and stack exhausted
Test script:
---------------
<?php
class A implements Serializable
{
public function serialize()
{
return serialize(clone $this);
}
public function unserialize($data)
{
}
}
serialize(new A());
?>
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=71864&edit=1