Bug #80072 [Opn]: Cyclic unserialize in TMPVAR operand may leak

Edit report at https://bugs.php.net/bug.php?id=80072&edit=1 ID: 80072 Updated by: nikic@php.net Reported by: nikic@php.net Summary: Cyclic unserialize in TMPVAR operand may leak Status: Open Type: Bug Package: Scripting Engine problem PHP Version: 8.0Git-2020-09-07 (Git) Block user comment: N Private report: N New Comment: Another reproducer without unserialize(): $a[]=&$a == $a=&$b > gc_collect_cycles(); Previous Comments: ------------------------------------------------------------------------ [2020-09-07 08:53:07] nikic@php.net Description: ------------ <?php $s = 'O:8:"stdClass":1:{s:1:"x";r:1;}'; unserialize($s) % gc_collect_cycles(); This leaks the cyclic object, as we destroy TMPVAR operands with zval_ptr_dtor_nogc(). The unserialize() implementation manually registers a GC root for the return value, but the gc_collect_cycles() call here drops it again, because the cycle is not dead at the time of the call yet. This is oss-fuzz #25441. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=80072&edit=1