Bug #78409 [NEW]: Segfault when creating instance of ArrayIterator without constructor
From: nicolas dot grekas+php at gmail dot com
Operating system:
PHP version: 7.4.0beta2
Package: Reproducible crash
Bug Type: Bug
Bug description:Segfault when creating instance of ArrayIterator without constructor
Description:
------------
This is related to the new serialization mechanism of PHP 7.4.
I don't have a better reproducer because when I try to isolate the
crash, it works...
Here is my reproducer, sorry I don't have a better one for now:
Clone https://github.com/nicolas-grekas/symfony
checkout branch "ve-php74"
Then run
./phpunit src/Symfony/Component/VarExporter/ --do-not-cache-result
--filter testExport#6
boom
What the code does is that it:
- uses newInstanceWithoutConstructor to create an ArrayIterator
- clones that instance
- calls __unserialize on the clone instance with a valid payload
The crash happens after these step, when e.g. calling print_r() on the
object.
When done "manually", it works. But in the context of the test case, it
segfaults.
--
Edit bug report at https://bugs.php.net/bug.php?id=78409&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=78409&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=78409&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=78409&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=78409&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=78409&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=78409&r=support
Expected behavior: https://bugs.php.net/fix.php?id=78409&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=78409&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=78409&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=78409&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=78409&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=78409&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=78409&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=78409&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=78409&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=78409&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=78409&r=mysqlcfg
Thread (3 messages)
- nicolas dot grekas+php at gmail dot com