Skip to content

Fix GH-25299: Exception string code is lost after unserialize() #25301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
lazerg wants to merge 2 commits into from
Closed

Fix GH-25299: Exception string code is lost after unserialize() #25301

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cdd131f
Fix GH-25299: Exception string code is lost after unserialize()
lazerg Nov 8, 2026
39aaf23
Dereference exception message and code before the __wakeup type check
lazerg Nov 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions Zend/tests/gh25299.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
--TEST--
GH-25299 (Exception string code is lost after unserialize())
--CREDITS--
tacman
--FILE--
<?php

class MyException extends Exception {
protected $code = 'HY000';
}

$e = unserialize(serialize(new MyException()));
var_dump($e->getCode());

$e = unserialize('O:9:"Exception":1:{s:7:"' . "\0*\0" . 'code";a:0:{}}');
var_dump($e->getCode());

?>
--EXPECTF--
string(5) "HY000"

Warning: Undefined property: Exception::$code in %s on line %d
NULL
22 changes: 22 additions & 0 deletions Zend/tests/gh25299_ref.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
--TEST--
GH-25299: Exception::__wakeup() keeps message and code held by reference
--FILE--
<?php

class MyException extends Exception {
public $m = 'm';
public $c = 5;

public function __construct() {
$this->message = &$this->m;
$this->code = &$this->c;
}
}

$e = unserialize(serialize(new MyException()));
var_dump($e->getMessage(), $e->getCode());

?>
--EXPECT--
string(1) "m"
int(5)
9 changes: 5 additions & 4 deletions Zend/zend_exceptions.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -347,9 +347,10 @@ ZEND_METHOD(Exception, __construct)
/* }}} */

/* {{{ Exception unserialize checks */
#define CHECK_EXC_TYPE(id, type) \
#define CHECK_EXC_TYPE(id, type_mask) \
pvalue = zend_read_property_ex(i_get_exception_base(Z_OBJ_P(object)), Z_OBJ_P(object), ZSTR_KNOWN(id), 1, &value); \
if (Z_TYPE_P(pvalue) != IS_NULL && Z_TYPE_P(pvalue) != type) { \

@devnexen devnexen Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

--- a/Zend/zend_exceptions.c
+++ b/Zend/zend_exceptions.c
@@ -349,6 +349,7 @@ ZEND_METHOD(Exception, __construct)
 /* {{{ Exception unserialize checks */
 #define CHECK_EXC_TYPE(id, type) \
        pvalue = zend_read_property_ex(i_get_exception_base(Z_OBJ_P(object)), Z_OBJ_P(object), ZSTR_KNOWN(id), 1, &value); \
+       ZVAL_DEREF(pvalue); \
        if (Z_TYPE_P(pvalue) != IS_NULL && Z_TYPE_P(pvalue) != type) { \
                zend_unset_property(i_get_exception_base(Z_OBJ_P(object)), Z_OBJ_P(object), ZSTR_VAL(ZSTR_KNOWN(id)), ZSTR_LEN(ZSTR_KNOWN(id))); \
        }

@devnexen devnexen Nov 8, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

with this test

--TEST--
Exception::__wakeup() keeps message and code held by reference
--FILE--
<?php

class MyException extends Exception {
    public $m = 'm';
    public $c = 5;

    public function __construct() {
        $this->message = &$this->m;
        $this->code = &$this->c;
    }
}

$e = unserialize(serialize(new MyException()));
var_dump($e->getMessage(), $e->getCode());

?>
--EXPECT--
string(1) "m"
int(5)

@lazerg lazerg Nov 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done in 39aaf23

ZVAL_DEREF(pvalue); \
if (Z_TYPE_P(pvalue) != IS_NULL && !((type_mask) & (1u << Z_TYPE_P(pvalue)))) { \
zend_unset_property(i_get_exception_base(Z_OBJ_P(object)), Z_OBJ_P(object), ZSTR_VAL(ZSTR_KNOWN(id)), ZSTR_LEN(ZSTR_KNOWN(id))); \
}

Expand All @@ -359,8 +360,8 @@ ZEND_METHOD(Exception, __wakeup)

zval value, *pvalue;
zval *object = ZEND_THIS;
CHECK_EXC_TYPE(ZEND_STR_MESSAGE, IS_STRING);
CHECK_EXC_TYPE(ZEND_STR_CODE, IS_LONG);
CHECK_EXC_TYPE(ZEND_STR_MESSAGE, MAY_BE_STRING);
CHECK_EXC_TYPE(ZEND_STR_CODE, MAY_BE_LONG | MAY_BE_STRING);
/* The type of all other properties is enforced through typed properties. */
}
/* }}} */
Expand Down
Loading