[php-src] PR #23981: ext/standard: Don't share the unserialize() context with enum autoloaders

From: Date: Tue, 29 Sep 2026 08:34:52 +0000
Subject: [php-src] PR #23981: ext/standard: Don't share the unserialize() context with enum autoloaders
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38912@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/23981 Author: nicolas-grekas The E: branch of the unserializer runs the autoloader, and the constant expression of a backed case, without BG(serialize_lock), unlike the O: branch. An unserialize() call made from there reuses the context of the outer one, so the outer back-references resolve to the values it created, and its __unserialize() calls are delayed until the outer call returns: ```php spl_autoload_register(function ($class) { unserialize('O:8:"stdClass":1:{s:1:"a";s:6:"nested";}'); eval("enum $class { case On; }"); }); $v = unserialize('a:3:{i:0;E:7:"Lazy:On";i:1;O:8:"stdClass":1:{s:1:"a";s:5:"outer";}i:2;r:3;}'); echo $v[2]->a; // nested, instead of outer ``` Same since 8.1. #19883 would cover this as a side effect, but it changes how unserialize() nests from Serializable::unserialize(); this one only aligns the E: branch with the O: one.

« previous php.git-pulls (#38912) next »