-
Notifications
You must be signed in to change notification settings - Fork 8k
Closed
Labels
Description
Description
I had a already started session and let php unserialize a object of the following class:
<?php
namespace ClxProductNet\PriceSwitch\Model;
use ClxProductNet_SessionNS;
final class PriceSwitchSession implements \Serializable
{
// php 7.x serialization
public function serialize()
{
return serialize($this->__serialize());
}
// php 7.x serialization
public function unserialize($data): void
{
$this->__unserialize(unserialize($data));
}
// php 8.1+ serialization
public function __unserialize(string $data): void /* <-- wrong data-type */
{
}
}
Resulted in this output:
- segmentation fault
But I expected this output instead:
- regular fatal error
the segfault goes away when I change the type of the parameter given to __unserialize from string to array.
array is of course the correct type, but a wrong type should not lead to a segfault
php -v
PHP 8.1.18 (cli) (built: Apr 14 2023 04:39:44) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.1.18, Copyright (c) Zend Technologies
PHP Version
8.1.18
Operating System
Ubuntu22
Reactions are currently unavailable