Bug #74436 [Opn]: Mixing Serializable and __wakeup() causes conflict

Edit report at https://bugs.php.net/bug.php?id=74436&edit=1 ID: 74436 User updated by: tom at altrooz dot com Reported by: tom at altrooz dot com Summary: Mixing Serializable and __wakeup() causes conflict Status: Open Type: Bug Package: Class/Object related Operating System: Centos 6 PHP Version: 5.6.30 Block user comment: N Private report: N New Comment: And introducing a new significant flaw in security update 5.6.30 isn't a concern? As stated, I was not able to create a reproducable case but it seems a code review of http://bugs.php.net/70213 and http://bugs.php.net/73825 might be wise. Previous Comments: ------------------------------------------------------------------------ [2017-04-14 17:49:35] danack@php.net The version of PHP you've reported this bug for is only receiving security updates. If you can't provide a reproduce case that shows the problem in PHP 7, it is unlikely that anyone would look at this. ------------------------------------------------------------------------ [2017-04-13 20:41:57] tom at altrooz dot com Description: ------------ This issue was introduced in 5.6.30, and does not exist in 5.6.29. Unfortunately the data structures that showed this effect are too complicated to include, and my effort to create a smaller reproducable case was not successful. But here's the story: *) A class implemented Serializable *) It has a member of type SplFixedArray, which has a __wakeup() function *) The container held other class instances that did not override the default serialization behavior *) Some of those classes included instances of ImmutableDateTime, which also has a __wakeup() function When unserializing the top-level class, the __wakeup() function on the SplFixedArray and ImmutableDateTime instances did not get called. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=74436&edit=1