Repository navigation
Fix deepclone_from_array() issues reported in symfony/polyfill#717 - #64
Merged
Merged
Conversation
nicolas-grekas
force-pushed
the
fuzz-717
branch
from
October 14, 2026 07:20
5c032f2 to
054cc6e
Compare
nicolas-grekas
force-pushed
the
fuzz-717
branch
from
October 14, 2026 07:20
054cc6e to
178e0f2
Compare
nicolas-grekas
added a commit
to symfony/polyfill
that referenced
this pull request
Oct 14, 2026
…colas-grekas) This PR was merged into the 1.x branch. Discussion ---------- [DeepClone] Report malformed payloads like the extension | Q | A | ------------- | --- | Branch? | 1.x | Bug fix? | yes | New feature? | no | Deprecations? | no | Issues | Fix #717 | License | MIT The extension gets its side in symfony/php-ext-deepclone#64. - An object that only `__unserialize()` can create, eg a `HashContext`, can be referenced before its state is replayed. A missing or malformed state is now reported instead of "unknown object id". - A non-array state throws the `TypeError` of `__unserialize()`, without mentioning DeepClone.php. - Binding a reference to a dynamic property doesn't report the deprecation to error handlers anymore. `@` silenced it, but Symfony's ErrorHandler still logged it. - Messages cut scopes, property names and `"objectMeta"` indexes at their first NUL byte. The closure index of a const-expr closure is checked before its site, like in the extension. - No more "Undefined array key" warnings for unknown ids in the scope of an internal class. I didn't check the scope of each object of a property (item 1 of the issue). That costs 3% on `deepclone_from_array()`, for payloads that `deepclone_to_array()` never produces. I left the order of the checks (item 5) and the extra warning of `unserialize()` (item 8) as is too. Both sides reject these payloads. Commits ------- e273755 [DeepClone] Report malformed payloads like the extension
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reported in symfony/polyfill#717, which gets the polyfill side in symfony/polyfill#718.
"objectMeta"were read as 32-bit integers, so4294967295read as-1and-4294967296as no flag. Only their sign matters now.deepclone_from_array()returns lazy ghosts, it checks the markers of their properties and states right away, like for other objects. Unknown object or ref ids, values of the wrong type and malformed closures were reported on first access before. What depends on the code, eg a function or an enum case that doesn't exist, still fails on first access.The most common marker, an object id, is checked inline:
deepclone_from_array()of 1000 objects holding closures runs 1.5% fewer instructions.