Bug #81153 [NEW]: bypass __wakeup

From: j7ur8 at qq dot com Operating system: ALL PHP version: 7.3.28 Package: Class/Object related Bug Type: Bug Bug description:bypass __wakeup Description: ------------ bad unserialize string makes __wakeup ineffective. Success: 7.0.15 - 7.0.33, 7.1.1 - 7.1.33, 7.2.0 - 7.2.34, 7.3.0 - 7.3.28, 7.4.0 - 7.4.16, 8.0.0 - 8.0.3 Fail: 5.0.0 - 5.0.5, 5.1.0 - 5.1.6, 5.2.0 - 5.2.17, 5.3.0 - 5.3.29, 5.4.0 - 5.4.45, 5.5.0 - 5.5.38, 5.6.0 - 5.6.40, 7.0.0 - 7.0.14, 7.1.0 Test script: --------------- // https://3v4l.org/4nZUm <?php class D{ public $flag=True; public function __get($a){ if($this->flag){ echo 'flag'; }else{ echo 'hint'; } } public function __wakeup(){ $this->flag = False; } } class C{ public function __destruct(){ echo $this->c->b; } } @unserialize('O:1:"C":1:{s:1:"c";O:1:"D":0:{};N;}'); Expected result: ---------------- hint Actual result: -------------- flag -- Edit bug report at https://bugs.php.net/bug.php?id=81153&edit=1 -- Fix committed: https://bugs.php.net/fix.php?id=81153&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=81153&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=81153&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=81153&r=needscript Try newer version: https://bugs.php.net/fix.php?id=81153&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=81153&r=support Expected behavior: https://bugs.php.net/fix.php?id=81153&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=81153&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=81153&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=81153&r=globals PHP version support discontinued: https://bugs.php.net/fix.php?id=81153&r=phptooold Daylight Savings: https://bugs.php.net/fix.php?id=81153&r=dst IIS Stability: https://bugs.php.net/fix.php?id=81153&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=81153&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=81153&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=81153&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=81153&r=mysqlcfg