Bug #70767 [Ana->Csd]: crash after script execution

Edit report at https://bugs.php.net/bug.php?id=70767&edit=1 ID: 70767 Updated by: nikic@php.net Reported by: liska at avast dot com Summary: crash after script execution -Status: Analyzed +Status: Closed Type: Bug Package: Reproducible crash Operating System: windows 7 64-bit PHP Version: 7.0.1 -Assigned To: +Assigned To: nikic Block user comment: N Private report: N New Comment: This has been fixed in 7.0.14 by https://github.com/php/php-src/commit/b2af4e8868726a040234de113436c6e4f6372d17. Previous Comments: ------------------------------------------------------------------------ [2015-12-31 23:56:34] stas@php.net Still reproduces on 7.x, but not sure what is the cause yet. The references are allowed in serialized objects, but it's true you can mess things up if you do them maliciously. Not sure yet how to fix it. ------------------------------------------------------------------------ [2015-10-23 23:18:46] ryat@php.net @laruence reference in Serializable object is allowed. and 5.x branchs is right. you can see these: https://3v4l.org/HTQUL https://3v4l.org/JvrVs you script has triggered UAF/memory corruption in php7.x, so the result is strange. ------------------------------------------------------------------------ [2015-10-23 09:23:27] laruence@php.net @stas what do you think ? since you have been working on serialize issues for some times ------------------------------------------------------------------------ [2015-10-23 08:49:23] laruence@php.net should be: https://3v4l.org/GcebX ------------------------------------------------------------------------ [2015-10-23 08:48:24] laruence@php.net maybe the 5.6 behaviors wrongly , https://3v4l.org/new reference to a internal (external) object is not allowed. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=70767 -- Edit this bug report at https://bugs.php.net/bug.php?id=70767&edit=1