diff --git a/ext/standard/tests/serialize/bug81111.phpt b/ext/standard/tests/serialize/bug81111.phpt new file mode 100644 index 0000000000000..e28d24f065de2 --- /dev/null +++ b/ext/standard/tests/serialize/bug81111.phpt @@ -0,0 +1,62 @@ +--TEST-- +Bug #81111 () +--FILE-- +getMessage() . "\n"; + } +} + +function make_alias($obj) { + class_alias(get_class($obj), 'SomeAlias'); + return new SomeAlias(); +} + +echo "Case 1: anonymous class\n"; +check_serialize_throws(new class () {}); + +echo "\n"; +echo "Case 2: anonymous class with __serialize\n"; +check_serialize_throws(new class () { + public function __serialize() { return []; } + public function __unserialize($value) { } +}); + +echo "\n"; +echo "Case 3: anonymous class with Serializable\n"; +check_serialize_throws(new class () implements Serializable { + public function serialize() { return ''; } + public function unserialize(string $ser) { return new self(); } +}); + +echo "\n"; +echo "Case 4: aliased anonymous class with __serialize\n"; +$alias = make_alias(new class() { + public function __serialize() { return []; } +}); +check_serialize_throws($alias); + +?> +--EXPECTF-- +Case 1: anonymous class +Caught: Exception +Message: Serialization of 'class@anonymous' is not allowed + +Case 2: anonymous class with __serialize +Caught: Exception +Message: Serialization of 'class@anonymous' is not allowed + +Case 3: anonymous class with Serializable + +Deprecated: The Serializable interface is deprecated. %s +Caught: Exception +Message: Serialization of 'Serializable@anonymous' is not allowed + +Case 4: aliased anonymous class with __serialize +Caught: Exception +Message: Serialization of 'class@anonymous' is not allowed diff --git a/ext/standard/var.c b/ext/standard/var.c index 986f8236bf402..30aa030b8c0c0 100644 --- a/ext/standard/var.c +++ b/ext/standard/var.c @@ -23,6 +23,7 @@ #include "php.h" #include "php_string.h" #include "php_var.h" +#include "zend_interfaces.h" #include "zend_smart_str.h" #include "basic_functions.h" #include "php_incomplete_class.h" @@ -1075,7 +1076,7 @@ static void php_var_serialize_intern(smart_str *buf, zval *struc, php_serialize_ return; } - if (ce->__serialize) { + if (ce->__serialize && ce->serialize != zend_class_serialize_deny) { zval retval, obj; zend_string *key; zval *data;