Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:74984
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.128.174 as permitted sender)
MIME-Version: 1.0
Sender: julienpauli@gmail.com
In-Reply-To: <53A21137.6010705@sugarcrm.com>
References: <CAH-PCH6xEXspisLOHtiTbViA4vDTk7q6LM3t_Bh9Dzr1cj_Nag@mail.gmail.com>
 <53A1C722.9060501@fedoraproject.org> <53A21137.6010705@sugarcrm.com>
Date: Thu, 19 Jun 2014 11:01:38 +0200
Message-ID: <CAMUwpuT_S2EE6cdJM95RzY4vmORGx3vJ9+gau8G3EZCMsNSydA@mail.gmail.com>
To: Stas Malyshev <smalyshev@sugarcrm.com>
Cc: Remi Collet <remi@fedoraproject.org>, PHP Internals <internals@lists.php.net>
Content-Type: text/plain; charset=UTF-8
Subject: Re: [PHP-DEV] Re: Problems with the fix for the BC break introduced
 in 5.4.29 and 5.5.13
From: jpauli@php.net (Julien Pauli)

On Thu, Jun 19, 2014 at 12:22 AM, Stas Malyshev <smalyshev@sugarcrm.com> wrote:
> Hi!
>
>> My proposal, for a quick solution, trying to be pragmatic and
>> trying to make the most of php users happy.
>
> Is the solution of banning only the internal classes with create_object
> and their descendants unsatisfactory?

For me, it's a safe solution, however, it breaks BC, I think it's a
no-go for 5.4 and 5.5.
This however could be a 5.6+ solution.

For 5.4 and 5.5, there doesn't seem to be easy fix on the go.
I suggest following what Remi suggests :

- Revert the BC break in 5.5 and 5.4
- Keep the segfault, we've been living with it for ages
- Patch the manual to clearly show one should never try to unserialize
hand-made strings : we just do not support such behavior (thus, it
could lead to segfaults)
- What if tomorrow we replace our serializer by igbinary or so ? Users
should not be aware of internal details, serialized string is
definetly one

Julien