#35369 [Opn->Fbk]: Serialized objects referencing each other, memory exhaustion when unserializing

ID: 35369 Updated by: tony2001@php.net Reported By: bugreports at insign dot ch -Status: Open +Status: Feedback Bug Type: Class/Object related Operating System: Prolly irrelevant (Linux 2.6.4) PHP Version: 5CVS-2005-11-24 (CVS) New Comment: Thank you for this bug report. To properly diagnose the problem, we need a backtrace to see what is happening behind the scenes. To find out how to generate a backtrace, please read http://bugs.php.net/bugs-generating-backtrace.php Once you have generated a backtrace, please submit it to this bug report and change the status back to "Open". Thank you for helping us make PHP better. Previous Comments: ------------------------------------------------------------------------ [2005-11-24 16:15:19] bugreports at insign dot ch Description: ------------ Objects, referencing each other, are serialized. The reference seems to be represented as R:1 in the serialized data. When unserializing the string, it seems (begin of guess) that the reference is not interpreted correctly and countless objects are instantiated instead (end of guess) - the script takes remarkably long and ends with the allowed memory size exhausted. The problem doesn't seem to occur when the unserialized data is simply echoed instead of assigned to a variable, but obviously that's not so useful. The problem still occurs when var_dumping the unserialized data. The problem exists on PHP 5.1.0RC6, but not on PHP 5.0.5. Unfortunately, we cannot install the CVS version just for checking if the problem still exists. We hope you're still willing to at least quickly verify it. Reproduce code: --------------- class A { public $b; } class B { public $a; } $a = new A(); $b = new B(); $a->b = &$b; $b->a = &$a; $x = unserialize(serialize($a)); Expected result: ---------------- $x is a copy of $a, with $x->b being a copy of $b that holds a reference to $x. print_r'd that would look like this: A Object ( [b] => B Object ( [a] => A Object *RECURSION* ) ) Actual result: -------------- Memory exhaustion and sometimes a segmentation fault. ------------------------------------------------------------------------ -- Edit this bug report at http://bugs.php.net/?id=35369&edit=1