#34045 [Opn->Ver]: Buffer overflow with serialized object

ID: 34045 Updated by: rasmus@php.net Reported By: david dot tulloh at anu dot edu dot au -Status: Open +Status: Verified Bug Type: Class/Object related Operating System: Debian Linux PHP Version: 5CVS-2005-08-09 (dev) New Comment: Verified here: http://lerdorf.com/valgrind.txt Previous Comments: ------------------------------------------------------------------------ [2005-08-09 07:15:57] david dot tulloh at anu dot edu dot au Description: ------------ The attached code triggers what looks to me like a buffer overflow. I've been able to reproduce it on two different computers running a current and slightly older version of PHP CVS. Reproducable through both the CLI and Apache2. I stumbled across this while trying to extend SimpleTest and then cut the code back to the smallest reproduceable subset. I suspect that the problem starts when serializing-deserializing the singleton object. All the layers of seemingly redundant OOP are then required to bring out the error. I really have no idea why though. originally sent to security@php.net. Reproduce code: --------------- http://cmhr118130.anu.edu.au:100/overflow.phps Expected result: ---------------- ClassWithError::__construct - 42 - type = string(14) "BasicSingleton" ClassWithError::__construct - 44 - type = string(14) "BasicSingleton" Actual result: -------------- (continues past what's shown): ClassWithError::__construct - 42 - type = string(14) "BasicSingleton" ClassWithError::__construct - 44 - type = string(137552044) "tI3 PÜ]d_ÀlÔO`F &&!ðMOClassWithError9@OO¤O1`OÈO 1OøO 1ÈOÐP ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=34045&edit=1