Merge pull request from GHSA-442f-wcwq-fpcf

Fix for CVE-2022-41922

Author: marcovtwout

CHANGELOG

@@ -5,6 +5,7 @@ Version 1.1.27 under development
 --------------------------------
 
 - Bug: PHP 8.1 compatibility: Fix CFileCache call of file_get_contents (Bregi)
+- Bug: CVE-2022-41922. Prevent RCE when deserializing untrusted user input (fi3wey, marcovtwout)
 
 Version 1.1.26 September 30, 2022
 --------------------------------

framework/db/schema/CDbCriteria.php

@@ -168,18 +168,21 @@ public function __wakeup()
 	{
 		$map=array();
 		$params=array();
-		foreach($this->params as $name=>$value)
+		if(is_array($this->params))
 		{
-			if(strpos($name,self::PARAM_PREFIX)===0)
+			foreach($this->params as $name=>$value)
 			{
-				$newName=self::PARAM_PREFIX.self::$paramCount++;
-				$map[$name]=$newName;
-			}
-			else
-			{
-				$newName=$name;
+				if(strpos($name,self::PARAM_PREFIX)===0)
+				{
+					$newName=self::PARAM_PREFIX.self::$paramCount++;
+					$map[$name]=$newName;
+				}
+				else
+				{
+					$newName=$name;
+				}
+				$params[$newName]=$value;
 			}
-			$params[$newName]=$value;
 		}
 		if (!empty($map))
 		{