SplFixedArray incorrectly handles references in deserialization

Description

The following code:

<?
for ($i = 0; $i <= 2; $i++) {
    $tok = $conditions;
    $x[0] = &$$array;     
    $a[] = !$a; 
    $$a[0] =&rsort($a);
    unset($a[3][0]);
    $conditions = $b = new SplFixedArray(2);
    $b[0] = $$stdClassCollection = new SplObjectStorage;
    $v[0] = &$a;
    $a = unserialize(serialize($GLOBALS));
}

Resulted in this output:

Notice: Only variables should be assigned by reference in /path/to/poc.php on line 6
php: /path/to/php-src/Zend/zend_execute.h:216: void zend_safe_assign_to_variable_noref(zval *, zval *): Assertion `zval_get_type(&(*(variable_ptr))) != 10' failed.
Aborted

Commit:

56795d2810e

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Nov 29 2025 14:32:34) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
#3  0x00007ffff6845e2e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff6828888 in __GI_abort () at ./stdlib/abort.c:77
#5  0x00007ffff68287f0 in __assert_fail_base (fmt=<optimized out>, assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>) at ./assert/assert.c:118
#6  0x000055555bb38f39 in zend_safe_assign_to_variable_noref (variable_ptr=0x7bfff28a5100, value=0x7bfff39592e0) at Zend/zend_execute.h:216
#7  0x000055555bb31c1a in spl_fixedarray_object_unset_dimension_helper (intern=0x7bfff287f380, offset=0x7bfff284f5f0) at /home/dcarlier/Contribs/php-src/ext/spl/spl_fixedarray.c:465
#8  0x000055555bb350ff in spl_fixedarray_object_unset_dimension (object=0x7bfff287f3a0, offset=0x7bfff284f5f0) at /home/dcarlier/Contribs/php-src/ext/spl/spl_fixedarray.c:477
#9  0x000055555dd12cf6 in ZEND_UNSET_DIM_SPEC_VAR_CONST_TAILCALL_HANDLER (execute_data=0x7bfff2807020, opline=0x7bfff284eff0) at Zend/zend_vm_execute.h:82272
#10 0x000055555d42ca3f in execute_ex (ex=0x7bfff2807020) at Zend/zend_vm_execute.h:116212
#11 0x000055555d42eabf in zend_execute (op_array=0x7bfff288a000, return_value=0x0) at Zend/zend_vm_execute.h:121924
#12 0x000055555e64fb00 in zend_execute_script (type=8, retval=0x0, file_handle=0x7fffffffc2e0) at /home/dcarlier/Contribs/php-src/Zend/zend.c:1975
#13 0x000055555cb08d23 in php_execute_script_ex (primary_file=0x7fffffffc2e0, retval=0x0) at /home/dcarlier/Contribs/php-src/main/main.c:2645
#14 0x000055555cb09c09 in php_execute_script (primary_file=0x7fffffffc2e0) at /home/dcarlier/Contribs/php-src/main/main.c:2685
#15 0x000055555e6613cf in do_cli (argc=2, argv=0x7c2ff4de1bd0) at /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:951
#16 0x000055555e65d372 in main (argc=2, argv=0x7c2ff4de1bd0) at /home/dcarlier/Contribs/php-src/sapi/cli/php_cli.c:1362

SplFixedArray incorrectly handles references, I believe it shouldn't allow them:

<?php
$fa = new SplFixedArray(0);
$nr = 1;
$array = [&$nr];
$fa->__unserialize($array);
var_dump($fa);
unset($fa[0]);
var_dump($fa);

Fix phpGH-20614: SplFixedArray incorrectly handles references in dese…

Fix GH-20614: SplFixedArray incorrectly handles references in deseria…

Merge branch 'PHP-8.3' into PHP-8.4

Merge branch 'PHP-8.4' into PHP-8.5

Merge branch 'PHP-8.5'

Navigation Menu

Repository navigation

SplFixedArray incorrectly handles references in deserialization #20614

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

SplFixedArray incorrectly handles references in deserialization #20614

Description

Description

PHP Version

Operating System

Activity

devnexen commented on Nov 29, 2025

ndossche commented on Nov 29, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions