Bug #80072 [Opn->Csd]: Cyclic unserialize in TMPVAR operand may leak
Edit report at https://bugs.php.net/bug.php?id=80072&edit=1
ID: 80072
Updated by: git@php.net
Reported by: nikic@php.net
Summary: Cyclic unserialize in TMPVAR operand may leak
-Status: Open
+Status: Closed
Type: Bug
Package: Scripting Engine problem
PHP Version: 8.0Git-2020-09-07 (Git)
Block user comment: N
Private report: N
New Comment:
Automatic comment on behalf of nikic
Revision: https://github.com/php/php-src/commit/52cf7ab8a27ace6fbff60674d7aeecf4adec1bc8
Log: Fix bug #80072: Root live tmpvars after GC
Previous Comments:
------------------------------------------------------------------------
[2021-07-02 08:38:43] nikic@php.net
Another reproducer without unserialize():
$a[]=&$a == $a=&$b > gc_collect_cycles();
------------------------------------------------------------------------
[2020-09-07 08:53:07] nikic@php.net
Description:
------------
<?php
$s = 'O:8:"stdClass":1:{s:1:"x";r:1;}';
unserialize($s) % gc_collect_cycles();
This leaks the cyclic object, as we destroy TMPVAR operands with zval_ptr_dtor_nogc(). The
unserialize() implementation manually registers a GC root for the return value, but the
gc_collect_cycles() call here drops it again, because the cycle is not dead at the time of the call
yet.
This is oss-fuzz #25441.
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=80072&edit=1
Thread (3 messages)