[php-src] PR #24751: Fix GH-24674: Share the unserialize context only with Serializable
| From: | iliaal | Date: | Mon, 26 Oct 2026 15:45:38 +0000 |
| Subject: | [php-src] PR #24751: Fix GH-24674: Share the unserialize context only with Serializable | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-39917@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/24751
Author: iliaal
php_var_unserialize_init() hands the context of a parse in progress to any caller, so user code that
runs mid-parse and calls unserialize() (a destructor from a failed __unserialize() payload or the
GC, an error handler, an allowed_classes __toString(), a session_decode() overwrite) resolves R: and
r: into the outer value, including values being destroyed. The context is now shared only with the
unserialize handler of a C: payload, and only while serialize_lock is not held, as serialize() does;
fiber switches inside that handler now throw FiberError, so this targets master. #24433 fixes the
reported __unserialize() case on PHP-8.4.
Fixes #24674