Bug 617673 (CVE-2010-2531)

The upstream PHP 5.2.14 and 5.3.3 releases corrected an information disclosure flaw where the var_export() function would disclose data if a fatal error occurred due to recursion, memory_limit, or execution time.  The buffer is never cleared and is flushed to the user, regardless of the configured display_errors setting, because it is considered part of the output.  This could lead to a disclosure of possibly sensitive information.

The name CVE-2010-2531 has been assigned to this issue.

An example to test:

% cat test.php
#!/usr/bin/php
<?php
@$obj->p =& $obj;
var_export($obj, true);
?>
% php test.php
PHP Fatal error:  Nesting level too deep - recursive dependency? in test.php on line 4
stdClass::__set_state(array(
   'p' => 
  stdClass::__set_state(array(
     'p' => 
    stdClass::__set_state(array(
       'p' => 
      stdClass::__set_state(array(
% cat test2.php
#!/usr/bin/php
<?php
$a[] =& $a;
var_export($a, true);
?>
% php test2.php
PHP Fatal error:  Nesting level too deep - recursive dependency? in test.php on line 4
array (
  0 => 
  array (
    0 => 
    array (
      0 => 
      array (
        0 => 
        array (


The upstream changes prevent any output from displaying, so should only display the "PHP Fatal error".

The upstream fix:

http://svn.php.net/viewvc?view=revision&revision=301143