[php-src] Issue #24505: `Time\Duration::__unserialize()` accepts a "negative zero" payload.

Issue: https://github.com/php/php-src/issues/24505 Author: azjezz ### Description The following code: ```php <?php $payload = 'O:13:"Time\Duration":3:{s:7:"seconds";i:0;s:11:"nanoseconds";i:0;s:8:"negative";b:1;}'; $d = unserialize($payload); var_dump($d->negative); // expected: exception, or false. actual: true var_dump(Time\Duration::compare($d, Time\Duration::fromSeconds(0))); // int(0) var_dump($d->absolute()->negative); // actual: true (absolute() of a value is still "negative") echo json_encode($d), "\n"; // actual: {"seconds":0,"nanoseconds":0,"negative":true} echo serialize(Time\Duration::fromSeconds(0)->negate()), "\n"; // canonical zero: ...s:8:"negative";b:0;} // For comparison, other non-canonical payloads are rejected: try { unserialize('O:13:"Time\Duration":3:{s:7:"seconds";i:-1;s:11:"nanoseconds";i:0;s:8:"negative";b:0;}'); } catch (Exception $e) { echo get_class($e), ': ', $e->getMessage(), "\n"; } ``` Expected: an exception ("Invalid serialization data for Time\Duration object"), as for the other non-canonical payloads (negative seconds, nanoseconds >= 1e9), or a canonicalized zero with $negative === false. No public factory or arithmetic method can produce a zero duration with $negative === true. Actual: the object is created with seconds = 0, nanoseconds = 0, negative = true. compare() and == treat it as zero, but the public $negative property, json_encode(), serialize() and absolute() all expose the non-canonical sign. ### PHP Version ```plain PHP 8.5.4 (cli) (built: Mar 31 2026 17:40:26) (NTS) Copyright (c) The PHP Group Zend Engine v4.5.4, Copyright (c) Zend Technologies with Zend OPcache v8.5.4, Copyright (c), by Zend Technologies ``` ### Operating System MacOS