Fix #46192 (Serialization of ArrayObject with objects as storage)

2 files changed, 41 insertions, 1 deletions

diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 6f0bda0e2e..411c5ec47f 100755
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -1594,7 +1594,7 @@ void spl_array_unserialize_helper(spl_array_object *intern, const unsigned char
 	++p;
 
 	if (*p!='m') {
-		if (*p!='a') {
+		if (*p!='a' && *p!='O' && *p!='C') {
 			goto outexcept;
 		}
 		intern->ar_flags &= ~SPL_ARRAY_CLONE_MASK;
diff --git a/ext/spl/tests/array_025.phpt b/ext/spl/tests/array_025.phpt
new file mode 100644
index 0000000000..35893ea1ea
--- /dev/null
+++ b/ext/spl/tests/array_025.phpt
@@ -0,0 +1,40 @@
+--TEST--
+SPL: ArrayObject serialize with an object as storage
+--FILE--
+<?php
+$obj1 = new ArrayObject(new ArrayObject(array(1,2)));
+$s = serialize($obj1);
+$obj2 = unserialize($s);
+
+print_r($obj1);
+echo "$s\n";
+print_r($obj2);
+?>
+--EXPECT--
+ArrayObject Object
+(
+    [storage:ArrayObject:private] => ArrayObject Object
+        (
+            [storage:ArrayObject:private] => Array
+                (
+                    [0] => 1
+                    [1] => 2
+                )
+
+        )
+
+)
+C:11:"ArrayObject":76:{x:i:0;C:11:"ArrayObject":37:{x:i:0;a:2:{i:0;i:1;i:1;i:2;};m:a:0:{}};m:a:0:{}}
+ArrayObject Object
+(
+    [storage:ArrayObject:private] => ArrayObject Object
+        (
+            [storage:ArrayObject:private] => Array
+                (
+                    [0] => 1
+                    [1] => 2
+                )
+
+        )
+
+)