Repository navigation
object_properties_load() bypasses readonly property checks #19765
Description
Description
The following code:
<?php
$r = new \Random\Randomizer(new \Random\Engine\PcgOneseq128XslRr64());
$r->__unserialize([['engine' => new \Random\Engine\Xoshiro256StarStar()]]);
var_dump($r->engine::class);Resulted in this output:
string(32) "Random\Engine\Xoshiro256StarStar"
But I expected this output instead:
Error: Cannot modify readonly property Random\Randomizer::$engine
PHP Version
git master (probably any version)
Operating System
No response
Activity
TimWolla commentedon Sep 8, 2025
This is quite similar to #9186.
ndossche commentedon Sep 8, 2025
It bypasses all sorts of things: #9708
iluuu1994 commentedon Sep 8, 2025
Oof, that's not great. It seems we're missing at least type checks/coercion and exception handling (abort when the destructor fails).
Reference handling is somewhat odd, in that references are copied to the property, except if the reference has RC=1, then they are unwrapped. This leads to some odd behavior (https://3v4l.org/ojCPY), which depends on other references to the reference existing. This makes some sense, in that references are supposed to be transparent, but still seems odd. Reference operations are usually very explicit.
Anyway, given references are copied, this also means we'll need to coerce the value inside the reference, so this has some observable side-effects.
zend_API: Do not overwrite `readonly` properties in `object_propertie…