var_dump(SensitiveParameterValue) segfaults #16207
Description
Description
While I'm not sure directly using SensitiveParameterValue class is intended outside of the #[SensitiveParameter] attribute, it seems to be completely possible and at least somewhat documented.
If you do this and try to var_dump() an instance of that class (not the automaticaly-unwrapped variable you get with the attribute), PHP segfaults. This is in no way a normal thing to do and probably something you'd only ever encounter while debugging during dev, but it still shouldn't crash :)
I've only tested this on the CLI SAPI. Sadly not on the latest 8.3.x, but I didn't see anything in the changelog that suggested this has already been addressed.
The following code:
<?php
function sp(#[SensitiveParameter] string $str): void
{
var_dump($str);
}
function spv(SensitiveParameterValue $spv): void
{
var_dump($spv);
}
sp('a');
spv(new SensitiveParameterValue('p'));Resulted in this output:
string(1) "a"
Segmentation fault: 11
But I expected this output instead:
string(1) "a"
class SensitiveParameterValue#2 (0) {
}
PHP Version
8.3.2
Operating System
macOS Sequoia 15.0