Repository navigation
Crash in unserialize() #21824
Description
Description
Originally reported by @calysteon.
<?php
class Trigger {
public function __destruct() {
@unserialize('i:1;');
}
}
$payload = 'a:1019:{';
for ($i = 0; $i < 1017; $i++) {
$payload .= "i:$i;s:1:\"A\";";
}
// Entry that overflows into a second var_entries block
$payload .= 'i:1017;O:7:"Trigger":0:{}';
// Duplicate key overwrites Trigger, pushing it to dtor list (refcount stays at 1)
$payload .= 'i:1017;i:0;}';
$result = @unserialize($payload);PHP Version
-
Operating System
No response
Activity
prateekbhujel commentedon Apr 22, 2026
Opened #21828 with a fix.
The crash is from destructor reentry while the outer unserialize context is already being destroyed. The nested
unserialize()call can reuse that outer context after one of its var entry blocks has been freed. The patch clears the outer context before running the final cleanup, so reentrant calls allocate their own context instead.Fix phpGH-21824: Avoid unserialize context reuse during cleanup
Add destructor-hazard sections to defer reentrant destructors