Re: Re: Problems with the fix for the BC break introduced in 5.4.29 and 5.5.13

Hi! > The original SplFileObject segfault can be achived without any > unserialize trick, one can simply extend an internal class depending on > it's constructor for providing the required initial state, and simply > not call the parent::__construct() from the child: > http://3v4l.org/fqFC6 Unserialize is a problem because unserialize sometimes deals with external data, so if you can trick unserialize to crash, you may be able to cause at least DoS, maybe RCE. Just some crafted code is less a problem is this context. So I'd like very much to find a solution which allows to eliminate crashes in unserialize(). The question is can we do this without messing up phpunit and so too badly. -- Stanislav Malyshev, Software Architect SugarCRM: http://www.sugarcrm.com/ (408)454-6900 ext. 227