Skip to content

Fix serialize() throwing for arrays that refer to themselves through references of refcount 1 - #24446

Open
lacatoire wants to merge 1 commit into
php:PHP-8.5from
lacatoire:fix/serialize-reference-cycle-stack-8.5
Open

lacatoire wants to merge 1 commit into
php:PHP-8.5from
lacatoire:fix/serialize-reference-cycle-stack-8.5

Conversation

@lacatoire

Copy link
Copy Markdown
Member

References of refcount 1 are dereferenced by serialize() and never recorded in the variable table, so an array that contains itself through such references recurses until the stack limit and throws an Error. Protect against recursion only for the arrays reached through such a reference, so that arrays shared by several objects are still written in full.

To reproduce

<?php
function mk() { $p = ["n" => "p"]; $c = ["n" => "c"]; $c["parent"] = &$p; $p["children"][] = &$c; return $p; }
echo strlen(serialize(mk())), "\n";

php repro.php on PHP 8.5.4

Before: Error: Maximum call stack size of 8339456 bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached. Infinite recursion?

After: 131

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant