Nested unserialize() can expose an outer object while its __unserialize() data is still being parsed

Abierto
  • ¿Algo no está bien?
#25,056 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
25/100
Tipo de issue
Error
Claridad
Necesita aclaración
Estado de actividad
Activo
Stack tecnológico
c, php
Área
backend, security

Línea de trabajo

The issue provides a PHP reproducer that triggers the bug in php-src's unserialize. Investigate the C parser handling nested unserialize calls and shared reference tables; no specific files are named. A fix requires a design decision on rejecting references versus preserving cyclic payloads, and validation with the reproducer.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Description

A nested unserialize() call from Serializable::unserialize() shares the outer reference table. An r/R record can therefore resolve to an outer object whose __unserialize() data is still being parsed. At that point __unserialize() has not been queued and cannot be called because the outer parser frame is suspended.

If inner code only stores the object, identity is preserved and it is initialized later. If it accesses the object immediately, it observes incomplete userland properties and could reach uninitialized native state for internal classes.

Unlike GH-19860, this object is not fully parsed, so finishing pending callbacks at the nested boundary cannot fix this case.

Reproducer
<?php
class Outer {
    public string $value;

    public function __unserialize(array $data): void {
        $this->value = "ready";
    }
}

class Legacy implements Serializable {
    public function serialize(): string {
        return "";
    }

    public function unserialize(string $data): void {
        $object = unserialize($data);
        var_dump(isset($object->value));
    }

    public function __serialize(): array {
        return [];
    }

    public function __unserialize(array $data): void {}
}

$result = unserialize("O:5:\"Outer\":1:{i:0;C:6:\"Legacy\":4:{r:1;}}");
echo $result->value, "\n";

Output:

bool(false)
ready
Expected behavior

This needs a separate design decision. Rejecting these references prevents unsafe access, but breaks cyclic payloads that previously retained the object until initialization completed.

Lenguaje dominante
C
Estrellas
41.8k
Forks
8.5k
Merge medio
2 d 12 h
PR fusionados (30 d)
137

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de php/php-src

Todos los issues de php/php-src

Issues similares

Más issues de C

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.