Fixed bug #30791 (magic methods (__sleep/__wakeup/__toString) call __call if object...

diff --git a/Zend/tests/bug30791.phpt b/Zend/tests/bug30791.phpt
new file mode 100755 (executable)
index 0000000..f56bcfb
--- /dev/null
+++ b/Zend/tests/bug30791.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #30791 magic methods (__sleep/__wakeup/__toString) call __call if object is overloaded 
+--FILE--
+<?php
+class a {
+   public $a = 4;
+   function __call($a,$b) {
+       return "unknown method";
+   }
+}
+$b = new a;
+echo $b,"\n";
+$c = unserialize(serialize($b));
+echo $c,"\n";
+var_dump($c);
+?>
+--EXPECT--
+Object id #1
+Object id #2
+object(a)#2 (1) {
+  ["a"]=>
+  int(4)
+}

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 48b9b9106b85fb7729faab811b913e8bab7711b1..e64b02e43ba1ab518b41d299ed9a37018956b1de 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -892,6 +892,9 @@ ZEND_API int zend_std_cast_object_tostring(zval *readobj, zval *writeobj, int ty
        
        switch (type) {
                case IS_STRING:
+                       if (!zend_hash_exists(&Z_OBJCE_P(readobj)->function_table, "__tostring", sizeof("__tostring"))) {
+                               return FAILURE;
+                       }
                        ZVAL_STRING(&fname, "__tostring", 0);
                        if (call_user_function_ex(NULL, &readobj, &fname, &retval, 0, NULL, 0, NULL TSRMLS_CC) == SUCCESS) {
                                if (retval) {

diff --git a/ext/standard/var.c b/ext/standard/var.c
index 21605d21b9d239fecc6a8ad7a68b2c3730ae915a..fd92046ae611e2e054a5d692ebca8897c7c1d1bb 100644 (file)
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -696,7 +696,8 @@ static void php_var_serialize_intern(smart_str *buf, zval **struc, HashTable *va
                                        return;
                                }
                                
-                               if(Z_OBJCE_PP(struc) != PHP_IC_ENTRY) {
+                               if (Z_OBJCE_PP(struc) != PHP_IC_ENTRY &&
+                                   zend_hash_exists(&Z_OBJCE_PP(struc)->function_table, "__sleep", sizeof("__sleep"))) {
                                        INIT_PZVAL(&fname);
                                        ZVAL_STRINGL(&fname, "__sleep", sizeof("__sleep") - 1, 0);
                                        res = call_user_function_ex(CG(function_table), struc, &fname, 

diff --git a/ext/standard/var_unserializer.c b/ext/standard/var_unserializer.c
index 9580a51458632bc338385e1bbd036f40ad3437ac..bf81456a950eaf79c8491041d7a59aeea7be28ae 100644 (file)
--- a/ext/standard/var_unserializer.c
+++ b/ext/standard/var_unserializer.c
@@ -325,7 +325,8 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
                return 0;
        }
 
-       if(Z_OBJCE_PP(rval) != PHP_IC_ENTRY) {
+       if (Z_OBJCE_PP(rval) != PHP_IC_ENTRY &&
+           zend_hash_exists(&Z_OBJCE_PP(rval)->function_table, "__wakeup", sizeof("__wakeup"))) {
                INIT_PZVAL(&fname);
                ZVAL_STRINGL(&fname, "__wakeup", sizeof("__wakeup") - 1, 0);
                call_user_function_ex(CG(function_table), rval, &fname, &retval_ptr, 0, 0, 1, NULL TSRMLS_CC);

diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 69b7307013a79063181a559340f0c3f373efe794..6b9e66715cafd32b9712379bea1c881955130404 100644 (file)
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -329,7 +329,8 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
                return 0;
        }
 
-       if(Z_OBJCE_PP(rval) != PHP_IC_ENTRY) {
+       if (Z_OBJCE_PP(rval) != PHP_IC_ENTRY &&
+           zend_hash_exists(&Z_OBJCE_PP(rval)->function_table, "__wakeup", sizeof("__wakeup"))) {
                INIT_PZVAL(&fname);
                ZVAL_STRINGL(&fname, "__wakeup", sizeof("__wakeup") - 1, 0);
                call_user_function_ex(CG(function_table), rval, &fname, &retval_ptr, 0, 0, 1, NULL TSRMLS_CC);