Skip to content

ext/standard: Validate objects before queuing unserialize callbacks - #24433

Open
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/aph-224x
Open

iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/aph-224x

Conversation

@iliaal

@iliaal iliaal commented Oct 19, 2026

Copy link
Copy Markdown
Member

The unserializer now checks each object's closing brace before queuing __unserialize() or __wakeup(), so incomplete objects skip their callback and destructor. Related to #21716, which changes when already-queued callbacks are drained.

Check the closing brace before queuing __unserialize() or __wakeup().
Incomplete object records must use the same cleanup as invalid property
data, including destructor suppression.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant