[php-src] Issue #11743: Seralize incorrectly duplicates element in case of circular reference in array
| From: | IceNV | Date: | Wed, 19 Jul 2023 10:58:05 +0000 |
| Subject: | [php-src] Issue #11743: Seralize incorrectly duplicates element in case of circular reference in array | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-244997@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/11743
Author: IceNV
### Description
The following code:
```php
<?php
$a = ['id'=>1,'parent'=>null,'child'=>null];
$b = ['id'=>2,'parent'=>null,'child'=>null];
$a['child'] =&$b;
$b['parent'] = &$a;
echo serialize($a);
```
Resulted in this output:
```
a:3:{s:2:"id";i:1;s:6:"parent";N;s:5:"child";a:3:{s:2:"id";i:2;s:6:"parent";a:3:{s:2:"id";i:1;s:6:"parent";N;s:5:"child";R:4;}s:5:"child";N;}}
```
The problem is that in the 'child' array with id 2, 'parent' duplicates the root
array with id 1 instead of directly referencing it, something along the lines of :
```
a:3:{s:2:"id";i:1;s:6:"parent";N;s:5:"child";a:3:{s:2:"id";i:2;s:6:"parent";R:1;s:5:"child";N;}}
```
In any case, the parent array shouldn't be duplicated, as this can cause traversal issues or
modifications that won't properly propagate if code tries to modify the de-serialized array
(for instance modifying element 2's parent will not propagate to the root as it should), for
instance :
If I modify the original array :
````php
$a['id'] = 3;
echo($a['id'].','.$a['child']['parent']['id']);
````
echoes (properly) :
````
3,3
````
However, if I unserialize the aformentioned string, and apply the same operation, it echoes :
````
3,1
````
The reference is lost, as is apparent from the serialized form.
(Of course this is a trivial example but corresponds to something I've encountered working with
graph-type arrays)
### PHP Version
PHP 8.1.21 (FPM,CLI)
### Operating System
Debian 10 x64 (on WSL2 on Windows 10 x64) ; Debian 11 x64 (native)