Gecko [ www.ctm-euromeuble.fr ]

Name	Size	Permission	Date
001.phpt	2 KB	-rw-rw-r--	2022-10-31 11:36
002.phpt	781 B	-rw-rw-r--	2022-10-31 11:36
003.phpt	407 B	-rw-rw-r--	2022-10-31 11:36
004.phpt	644 B	-rw-rw-r--	2022-10-31 11:36
005.phpt	3.63 KB	-rw-rw-r--	2022-10-31 11:36
006.phpt	595 B	-rw-rw-r--	2022-10-31 11:36
__serialize_001.phpt	652 B	-rw-rw-r--	2022-10-31 11:36
__serialize_002.phpt	316 B	-rw-rw-r--	2022-10-31 11:36
__serialize_003.phpt	1.1 KB	-rw-rw-r--	2022-10-31 11:36
__serialize_004.phpt	2.47 KB	-rw-rw-r--	2022-10-31 11:36
__serialize_005.phpt	1.17 KB	-rw-rw-r--	2022-10-31 11:36
__serialize_006.phpt	361 B	-rw-rw-r--	2022-10-31 11:36
__serialize_007.phpt	317 B	-rw-rw-r--	2022-10-31 11:36
autoload_implements.inc	117 B	-rw-rw-r--	2022-10-31 11:36
autoload_interface.inc	70 B	-rw-rw-r--	2022-10-31 11:36
bug14293.phpt	558 B	-rw-rw-r--	2022-10-31 11:36
bug21957.phpt	584 B	-rw-rw-r--	2022-10-31 11:36
bug23298.phpt	257 B	-rw-rw-r--	2022-10-31 11:36
bug24063.phpt	365 B	-rw-rw-r--	2022-10-31 11:36
bug25378.phpt	1.91 KB	-rw-rw-r--	2022-10-31 11:36
bug26762.phpt	412 B	-rw-rw-r--	2022-10-31 11:36
bug27469.phpt	595 B	-rw-rw-r--	2022-10-31 11:36
bug28325.phpt	408 B	-rw-rw-r--	2022-10-31 11:36
bug30234.phpt	897 B	-rw-rw-r--	2022-10-31 11:36
bug31402.phpt	1.19 KB	-rw-rw-r--	2022-10-31 11:36
bug31442.phpt	161 B	-rw-rw-r--	2022-10-31 11:36
bug35895.phpt	503 B	-rw-rw-r--	2022-10-31 11:36
bug36424.phpt	1.17 KB	-rw-rw-r--	2022-10-31 11:36
bug37947.phpt	476 B	-rw-rw-r--	2022-10-31 11:36
bug42919.phpt	251 B	-rw-rw-r--	2022-10-31 11:36
bug43614.phpt	331 B	-rw-rw-r--	2022-10-31 11:36
bug45706.phpt	631 B	-rw-rw-r--	2022-10-31 11:36
bug46882.phpt	189 B	-rw-rw-r--	2022-10-31 11:36
bug49649.phpt	842 B	-rw-rw-r--	2022-10-31 11:36
bug49649_1.phpt	884 B	-rw-rw-r--	2022-10-31 11:36
bug49649_2.phpt	888 B	-rw-rw-r--	2022-10-31 11:36
bug55798.phpt	458 B	-rw-rw-r--	2022-10-31 11:36
bug62373.phpt	484 B	-rw-rw-r--	2022-10-31 11:36
bug62836_1.phpt	546 B	-rw-rw-r--	2022-10-31 11:36
bug62836_2.phpt	596 B	-rw-rw-r--	2022-10-31 11:36
bug64146.phpt	799 B	-rw-rw-r--	2022-10-31 11:36
bug64354_1.phpt	493 B	-rw-rw-r--	2022-10-31 11:36
bug64354_2.phpt	456 B	-rw-rw-r--	2022-10-31 11:36
bug64354_3.phpt	489 B	-rw-rw-r--	2022-10-31 11:36
bug65481.phpt	518 B	-rw-rw-r--	2022-10-31 11:36
bug65806.phpt	1.72 KB	-rw-rw-r--	2022-10-31 11:36
bug67072.phpt	378 B	-rw-rw-r--	2022-10-31 11:36
bug68044.phpt	417 B	-rw-rw-r--	2022-10-31 11:36
bug68545.phpt	560 B	-rw-rw-r--	2022-10-31 11:36
bug68594.phpt	382 B	-rw-rw-r--	2022-10-31 11:36
bug68976.phpt	540 B	-rw-rw-r--	2022-10-31 11:36
bug69139.phpt	285 B	-rw-rw-r--	2022-10-31 11:36
bug69152.phpt	653 B	-rw-rw-r--	2022-10-31 11:36
bug69210.phpt	707 B	-rw-rw-r--	2022-10-31 11:36
bug69425.phpt	935 B	-rw-rw-r--	2022-10-31 11:36
bug69793.phpt	739 B	-rw-rw-r--	2022-10-31 11:36
bug70172.phpt	855 B	-rw-rw-r--	2022-10-31 11:36
bug70172_2.phpt	1.07 KB	-rw-rw-r--	2022-10-31 11:36
bug70213.phpt	645 B	-rw-rw-r--	2022-10-31 11:36
bug70219.phpt	826 B	-rw-rw-r--	2022-10-31 11:36
bug70219_1.phpt	900 B	-rw-rw-r--	2022-10-31 11:36
bug70436.phpt	966 B	-rw-rw-r--	2022-10-31 11:36
bug70513.phpt	615 B	-rw-rw-r--	2022-10-31 11:36
bug70963.phpt	755 B	-rw-rw-r--	2022-10-31 11:36
bug71311.phpt	460 B	-rw-rw-r--	2022-10-31 11:36
bug71313.phpt	580 B	-rw-rw-r--	2022-10-31 11:36
bug71840.phpt	226 B	-rw-rw-r--	2022-10-31 11:36
bug71940.phpt	1.17 KB	-rw-rw-r--	2022-10-31 11:36
bug71995.phpt	562 B	-rw-rw-r--	2022-10-31 11:36
bug72229.phpt	869 B	-rw-rw-r--	2022-10-31 11:36
bug72663.phpt	1.14 KB	-rw-rw-r--	2022-10-31 11:36
bug72663_2.phpt	726 B	-rw-rw-r--	2022-10-31 11:36
bug72663_3.phpt	483 B	-rw-rw-r--	2022-10-31 11:36
bug72731.phpt	285 B	-rw-rw-r--	2022-10-31 11:36
bug72785.phpt	515 B	-rw-rw-r--	2022-10-31 11:36
bug73052.phpt	359 B	-rw-rw-r--	2022-10-31 11:36
bug73154.phpt	324 B	-rw-rw-r--	2022-10-31 11:36
bug73341.phpt	635 B	-rw-rw-r--	2022-10-31 11:36
bug73825.phpt	323 B	-rw-rw-r--	2022-10-31 11:36
bug74101.phpt	372 B	-rw-rw-r--	2022-10-31 11:36
bug74103.phpt	315 B	-rw-rw-r--	2022-10-31 11:36
bug74111.phpt	260 B	-rw-rw-r--	2022-10-31 11:36
bug74300.phpt	302 B	-rw-rw-r--	2022-10-31 11:36
bug74614.phpt	351 B	-rw-rw-r--	2022-10-31 11:36
bug75054.phpt	423 B	-rw-rw-r--	2022-10-31 11:36
bug76300.phpt	471 B	-rw-rw-r--	2022-10-31 11:36
bug78438.phpt	2.55 KB	-rw-rw-r--	2022-10-31 11:36
bug80411.phpt	563 B	-rw-rw-r--	2022-10-31 11:36
bug81163.phpt	349 B	-rw-rw-r--	2022-10-31 11:36
counting_of_references.phpt	216 B	-rw-rw-r--	2022-10-31 11:36
incomplete_class.phpt	1.2 KB	-rw-rw-r--	2022-10-31 11:36
invalid_signs_in_lengths.phpt	1.54 KB	-rw-rw-r--	2022-10-31 11:36
max_depth.phpt	4.77 KB	-rw-rw-r--	2022-10-31 11:36
precision.phpt	1.62 KB	-rw-rw-r--	2022-10-31 11:36
ref_to_failed_serialize.phpt	479 B	-rw-rw-r--	2022-10-31 11:36
serialization_arrays_001.phpt	1.97 KB	-rw-rw-r--	2022-10-31 11:36
serialization_arrays_002.phpt	6.76 KB	-rw-rw-r--	2022-10-31 11:36
serialization_arrays_003.phpt	3.78 KB	-rw-rw-r--	2022-10-31 11:36
serialization_arrays_004.phpt	3.63 KB	-rw-rw-r--	2022-10-31 11:36
serialization_arrays_005.phpt	7.5 KB	-rw-rw-r--	2022-10-31 11:36
serialization_error_002.phpt	1.55 KB	-rw-rw-r--	2022-10-31 11:36
serialization_miscTypes_001.phpt	7.43 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_001.phpt	2.37 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_002.phpt	7.06 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_003.phpt	1.7 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_004.phpt	1.2 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_005.phpt	5.3 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_006.phpt	990 B	-rw-rw-r--	2022-10-31 11:36
serialization_objects_007.phpt	1 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_008.phpt	783 B	-rw-rw-r--	2022-10-31 11:36
serialization_objects_009.phpt	961 B	-rw-rw-r--	2022-10-31 11:36
serialization_objects_010.phpt	784 B	-rw-rw-r--	2022-10-31 11:36
serialization_objects_011.phpt	4.47 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_012.phpt	4.26 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_013.phpt	7.83 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_014.phpt	4.67 KB	-rw-rw-r--	2022-10-31 11:36
serialization_objects_015.phpt	5.16 KB	-rw-rw-r--	2022-10-31 11:36
serialization_precision_001.phpt	569 B	-rw-rw-r--	2022-10-31 11:36
serialization_precision_002.phpt	624 B	-rw-rw-r--	2022-10-31 11:36
serialization_resources_001.phpt	800 B	-rw-rw-r--	2022-10-31 11:36
serialize_globals_var_refs.phpt	358 B	-rw-rw-r--	2022-10-31 11:36
sleep_deref.phpt	265 B	-rw-rw-r--	2022-10-31 11:36
sleep_mangled_name_clash.phpt	411 B	-rw-rw-r--	2022-10-31 11:36
sleep_undefined_declared_properties.phpt	759 B	-rw-rw-r--	2022-10-31 11:36
sleep_uninitialized_typed_prop.phpt	784 B	-rw-rw-r--	2022-10-31 11:36
splobjectstorage_negative_count.phpt	381 B	-rw-rw-r--	2022-10-31 11:36
typed_property_refs.phpt	1.48 KB	-rw-rw-r--	2022-10-31 11:36
unserializeS.phpt	287 B	-rw-rw-r--	2022-10-31 11:36
unserialize_abstract_class.phpt	291 B	-rw-rw-r--	2022-10-31 11:36
unserialize_classes.phpt	1.34 KB	-rw-rw-r--	2022-10-31 11:36
unserialize_error_001.phpt	657 B	-rw-rw-r--	2022-10-31 11:36
unserialize_large.phpt	726 B	-rw-rw-r--	2022-10-31 11:36
unserialize_leak.phpt	463 B	-rw-rw-r--	2022-10-31 11:36
unserialize_mem_leak.phpt	379 B	-rw-rw-r--	2022-10-31 11:36
unserialize_neg_iv_edge_cases.phpt	253 B	-rw-rw-r--	2022-10-31 11:36
unserialize_subclasses.phpt	630 B	-rw-rw-r--	2022-10-31 11:36

Rename

--TEST--
Bug #78549: Stack overflow due to nested serialized input
--FILE--
<?php

function create_nested_data($depth, $prefix, $suffix, $inner = 'i:0;') {
    return str_repeat($prefix, $depth) . $inner . str_repeat($suffix, $depth);
}

echo "Invalid max_depth:\n";
var_dump(unserialize('i:0;', ['max_depth' => 'foo']));
var_dump(unserialize('i:0;', ['max_depth' => -1]));

echo "Array:\n";
var_dump(unserialize(
    create_nested_data(128, 'a:1:{i:0;', '}'),
    ['max_depth' => 128]
) !== false);
var_dump(unserialize(
    create_nested_data(129, 'a:1:{i:0;', '}'),
    ['max_depth' => 128]
));

echo "Object:\n";
var_dump(unserialize(
    create_nested_data(128, 'O:8:"stdClass":1:{i:0;', '}'),
    ['max_depth' => 128]
) !== false);
var_dump(unserialize(
    create_nested_data(129, 'O:8:"stdClass":1:{i:0;', '}'),
    ['max_depth' => 128]
));

// Depth can also be adjusted using ini setting
echo "Ini setting:\n";
ini_set("unserialize_max_depth", 128);
var_dump(unserialize(create_nested_data(128, 'a:1:{i:0;', '}')) !== false);
var_dump(unserialize(create_nested_data(129, 'a:1:{i:0;', '}')));

// But an explicitly specified depth still takes precedence
echo "Ini setting overridden:\n";
var_dump(unserialize(
    create_nested_data(256, 'a:1:{i:0;', '}'),
    ['max_depth' => 256]
) !== false);
var_dump(unserialize(
    create_nested_data(257, 'a:1:{i:0;', '}'),
    ['max_depth' => 256]
));

// Reset ini setting to a large value,
// so it's clear that it won't be used in the following.
ini_set("unserialize_max_depth", 4096);

class Test implements Serializable {
    public function serialize() {
        return '';
    }
    public function unserialize($str) {
        // Should fail, due to combined nesting level
        var_dump(unserialize(create_nested_data(129, 'a:1:{i:0;', '}')));
        // Should succeeed, below combined nesting level
        var_dump(unserialize(create_nested_data(128, 'a:1:{i:0;', '}')) !== false);
    }
}
echo "Nested unserialize combined depth limit:\n";
var_dump(is_array(unserialize(
    create_nested_data(128, 'a:1:{i:0;', '}', 'C:4:"Test":0:{}'),
    ['max_depth' => 256]
)));

class Test2 implements Serializable {
    public function serialize() {
        return '';
    }
    public function unserialize($str) {
        // If depth limit is overridden, the depth should be counted
        // from zero again.
        var_dump(unserialize(
            create_nested_data(257, 'a:1:{i:0;', '}'),
            ['max_depth' => 256]
        ));
        var_dump(unserialize(
            create_nested_data(256, 'a:1:{i:0;', '}'),
            ['max_depth' => 256]
        ) !== false);
    }
}
echo "Nested unserialize overridden depth limit:\n";
var_dump(is_array(unserialize(
    create_nested_data(64, 'a:1:{i:0;', '}', 'C:5:"Test2":0:{}'),
    ['max_depth' => 128]
)));

?>
--EXPECTF--
Invalid max_depth:

Warning: unserialize(): max_depth should be int in %s on line %d
bool(false)

Warning: unserialize(): max_depth cannot be negative in %s on line %d
bool(false)
Array:
bool(true)

Warning: unserialize(): Maximum depth of 128 exceeded. The depth limit can be changed using the max_depth unserialize() option or the unserialize_max_depth ini setting in %s on line %d

Notice: unserialize(): Error at offset 1157 of 1294 bytes in %s on line %d
bool(false)
Object:
bool(true)

Warning: unserialize(): Maximum depth of 128 exceeded. The depth limit can be changed using the max_depth unserialize() option or the unserialize_max_depth ini setting in %s on line %d

Notice: unserialize(): Error at offset 2834 of 2971 bytes in %s on line %d
bool(false)
Ini setting:
bool(true)

Warning: unserialize(): Maximum depth of 128 exceeded. The depth limit can be changed using the max_depth unserialize() option or the unserialize_max_depth ini setting in %s on line %d

Notice: unserialize(): Error at offset 1157 of 1294 bytes in %s on line %d
bool(false)
Ini setting overridden:
bool(true)

Warning: unserialize(): Maximum depth of 256 exceeded. The depth limit can be changed using the max_depth unserialize() option or the unserialize_max_depth ini setting in %s on line %d

Notice: unserialize(): Error at offset 2309 of 2574 bytes in %s on line %d
bool(false)
Nested unserialize combined depth limit:

Warning: unserialize(): Maximum depth of 256 exceeded. The depth limit can be changed using the max_depth unserialize() option or the unserialize_max_depth ini setting in %s on line %d

Notice: unserialize(): Error at offset 1157 of 1294 bytes in %s on line %d
bool(false)
bool(true)
bool(true)
Nested unserialize overridden depth limit:

Warning: unserialize(): Maximum depth of 256 exceeded. The depth limit can be changed using the max_depth unserialize() option or the unserialize_max_depth ini setting in %s on line %d

Notice: unserialize(): Error at offset 2309 of 2574 bytes in %s on line %d
bool(false)
bool(true)
bool(true)