diff --git a/ext/spl/spl_heap.c b/ext/spl/spl_heap.c index 254fbde7b3ff..5d36266393b0 100644 --- a/ext/spl/spl_heap.c +++ b/ext/spl/spl_heap.c @@ -1257,6 +1257,10 @@ PHP_METHOD(SplHeap, __unserialize) Z_PARAM_ARRAY_HT(data) ZEND_PARSE_PARAMETERS_END(); + if (UNEXPECTED(spl_heap_consistency_validations(intern, true) != SUCCESS)) { + RETURN_THROWS(); + } + if (zend_hash_num_elements(data) != 2) { zend_throw_exception_ex(NULL, 0, "Invalid serialization data for %s object", ZSTR_VAL(intern->std.ce->name)); RETURN_THROWS(); @@ -1285,10 +1289,6 @@ PHP_METHOD(SplHeap, __unserialize) RETURN_THROWS(); } - if (EG(exception)) { - RETURN_THROWS(); - } - if (UNEXPECTED(spl_heap_consistency_validations(intern, false) != SUCCESS)) { RETURN_THROWS(); } diff --git a/ext/spl/tests/heap_unserialize_under_corruption_or_modification.phpt b/ext/spl/tests/heap_unserialize_under_corruption_or_modification.phpt new file mode 100644 index 000000000000..2e54be09ad1a --- /dev/null +++ b/ext/spl/tests/heap_unserialize_under_corruption_or_modification.phpt @@ -0,0 +1,30 @@ +--TEST-- +SplHeap should not accept unserialize data when it is corrupted or under modification +--FILE-- +__unserialize($array); + return $a < $b ? -1 : ($a == $b ? 0 : 1); + } +} + +$heap = new SplMaxHeap; +$heap->insert(1); +$array = $heap->__serialize(); + +$heap = new MyHeap; +$heap->insert(0); +try { + $heap->insert(2); +} catch (RuntimeException $e) { + echo $e->getMessage(), "\n"; +} + +?> +--EXPECT-- +Heap cannot be changed when it is already being modified.