delta/php-git.git/ext/standard/tests/serialize, branch master

Change the order of properties used for var_dump(), serialize(), comparison, etc.

2021-03-01T10:29:49+00:00

Now properties are ordered according to their layout in zend_object structure.

Initialize property to UNDEF on unserialize overwrite

2021-02-18T10:10:20+00:00

The UNDEF marker here is important to prevent the creation of
a reference to the property currently being overwritten, which
would then leak.

This fixes oss-fuzz 6029559193534464, which was incorrectly
merged into oss-fuzz #30584 (which is reported at
https://github.com/google/oss-fuzz/issues/5211).

Don't use unmangled name if property not found

2021-02-18T09:17:23+00:00

This restores the previous behavior for this case. We'll continue
to use the mangled name, even if it does not correspond to a
declared property.

This also fixes an assertion failure for the case of property
overwrite, as the add_new was not guaranteed to be "new" previously.

Fixes oss-fuzz #31045.

Restrict allowed usages of $GLOBALS

2021-01-06T11:46:24+00:00

This restricts allowed usage of $GLOBALS, with the effect that
plain PHP arrays can no longer contain INDIRECT elements.

RFC: https://wiki.php.net/rfc/restrict_globals_usage

Closes GH-6487.

Fix use-after-scope in SplObjectStorage::unserialize()

2021-01-05T11:44:17+00:00

Introduced by the recent switch to a zend_object. Unserialize the
object into a tmp_var to avoid leaving behind a stack reference.

Fixes oss-fuzz #29271.

Fix edge case serializing __PHP_Incomplete_Class properties.

2021-01-04T14:46:54+00:00

This was using strcmp instead of zend_string_equals_literal.
As a result, the property count didn't match the number of properties
being serialized if properties started with
"__PHP_Incomplete_Class\0" (unlikely)

(before, `'O:8:"Missing_":1:{}'` would be serialized, which failed to
unserialize)

Everywhere else expects the MAGIC_MEMBER to match exactly,
and this should use zend_string_equals_literal as an example for other code.

This has used strcmp since 2004 in deb84befae4bbc3686a4f2ed82b04e2cabae5dc0

Closes GH-6555

Fix another typed resource issue in unserialization

2020-12-07T11:36:09+00:00

We also need to discard old entries in the ref_props HT when values
are overwritten.

We should really forbid these kinds of overwrites. I believe they
can only occur in manually crafted serialization strings, and
cause so many problems...

Fixes oss-fuzz #28257.

Fix removal of type source during unserialization

2020-12-04T11:56:05+00:00

Missed a check for info in this code. Add it, and add an assertion
in type source removal to make it easier to catch this issue.

Fixes oss-fuzz #28208 and #28257.

Fix another ref source management bug in unserialize

2020-11-30T13:23:54+00:00

When we overwrite an existing property during unserialization,
we also have to drop the ref source from it.

Merge branch 'PHP-7.4' into PHP-8.0

2020-11-25T16:24:49+00:00

* PHP-7.4:
  Fixed bug #80411