#34045 [NEW]: Buffer overflow with serialized object

From: david dot tulloh at anu dot edu dot au Operating system: Debian Linux PHP version: 5CVS-2005-08-09 (dev) PHP Bug Type: Class/Object related Bug description: Buffer overflow with serialized object Description: ------------ The attached code triggers what looks to me like a buffer overflow. I've been able to reproduce it on two different computers running a current and slightly older version of PHP CVS. Reproducable through both the CLI and Apache2. I stumbled across this while trying to extend SimpleTest and then cut the code back to the smallest reproduceable subset. I suspect that the problem starts when serializing-deserializing the singleton object. All the layers of seemingly redundant OOP are then required to bring out the error. I really have no idea why though. originally sent to security@php.net. Reproduce code: --------------- http://cmhr118130.anu.edu.au:100/overflow.phps Expected result: ---------------- ClassWithError::__construct - 42 - type = string(14) "BasicSingleton" ClassWithError::__construct - 44 - type = string(14) "BasicSingleton" Actual result: -------------- (continues past what's shown): ClassWithError::__construct - 42 - type = string(14) "BasicSingleton" ClassWithError::__construct - 44 - type = string(137552044) "tI3 PÜ]d_ÀlÔO`F &&!ðMOClassWithError9@OO¤O1`OÈO 1OøO 1ÈOÐP -- Edit bug report at http://bugs.php.net/?id=34045&edit=1 -- Try a CVS snapshot (php4): http://bugs.php.net/fix.php?id=34045&r=trysnapshot4 Try a CVS snapshot (php5.0): http://bugs.php.net/fix.php?id=34045&r=trysnapshot50 Try a CVS snapshot (php5.1): http://bugs.php.net/fix.php?id=34045&r=trysnapshot51 Fixed in CVS: http://bugs.php.net/fix.php?id=34045&r=fixedcvs Fixed in release: http://bugs.php.net/fix.php?id=34045&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=34045&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=34045&r=needscript Try newer version: http://bugs.php.net/fix.php?id=34045&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=34045&r=support Expected behavior: http://bugs.php.net/fix.php?id=34045&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=34045&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=34045&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=34045&r=globals PHP 3 support discontinued: http://bugs.php.net/fix.php?id=34045&r=php3 Daylight Savings: http://bugs.php.net/fix.php?id=34045&r=dst IIS Stability: http://bugs.php.net/fix.php?id=34045&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=34045&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=34045&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=34045&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=34045&r=mysqlcfg