Bug #80072 [NEW]: Cyclic unserialize in TMPVAR operand may leak
From: nikic
Operating system:
PHP version: 8.0Git-2020-09-07 (Git)
Package: Scripting Engine problem
Bug Type: Bug
Bug description:Cyclic unserialize in TMPVAR operand may leak
Description:
------------
<?php
$s = 'O:8:"stdClass":1:{s:1:"x";r:1;}';
unserialize($s) % gc_collect_cycles();
This leaks the cyclic object, as we destroy TMPVAR operands with
zval_ptr_dtor_nogc(). The unserialize() implementation manually
registers a GC root for the return value, but the gc_collect_cycles()
call here drops it again, because the cycle is not dead at the time of
the call yet.
This is oss-fuzz #25441.
--
Edit bug report at https://bugs.php.net/bug.php?id=80072&edit=1
--
Fix committed: https://bugs.php.net/fix.php?id=80072&r=fixed
Fixed in release: https://bugs.php.net/fix.php?id=80072&r=alreadyfixed
Need backtrace: https://bugs.php.net/fix.php?id=80072&r=needtrace
Need Reproduce Script: https://bugs.php.net/fix.php?id=80072&r=needscript
Try newer version: https://bugs.php.net/fix.php?id=80072&r=oldversion
Not developer issue: https://bugs.php.net/fix.php?id=80072&r=support
Expected behavior: https://bugs.php.net/fix.php?id=80072&r=notwrong
Not enough info: https://bugs.php.net/fix.php?id=80072&r=notenoughinfo
Submitted twice: https://bugs.php.net/fix.php?id=80072&r=submittedtwice
register_globals: https://bugs.php.net/fix.php?id=80072&r=globals
PHP version support discontinued: https://bugs.php.net/fix.php?id=80072&r=phptooold
Daylight Savings: https://bugs.php.net/fix.php?id=80072&r=dst
IIS Stability: https://bugs.php.net/fix.php?id=80072&r=isapi
Install GNU Sed: https://bugs.php.net/fix.php?id=80072&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=80072&r=float
No Zend Extensions: https://bugs.php.net/fix.php?id=80072&r=nozend
MySQL Configuration Error: https://bugs.php.net/fix.php?id=80072&r=mysqlcfg
Thread (3 messages)
- nikic@php.net