Calling `unserialize()` inside `Serializable::unserialize()` allows the object to be manipulated before it has been restored.

Description

The following code:

<?php
$v_116868 = 1;
$v_116869 = (int)($v_116868);
$v_116870 = error_reporting($v_116869,);
$v_116871 = '---------------- create, serialize, and unserialize a Point -------------------\n';
$v_116872 = 2;
$v_116897 = $value1;
$v_116898 = new BcMath\Number($v_116897,);
$v_116900 = $value2;
$v_116902 = (int)($v_116900);
$v_116903 = $v_116898 * $v_116902;
class Point implements Serializable
{
        private static $nextId = 1;

        private $x;
        private $y;
        private $id;

        public function __construct($x = 0, $y = 0)
        {
                $this->x = $x;
                $this->y = $y;
                $this->id = self::$nextId++;

                echo "\nInside " . __METHOD__ . ", $this\n\n";
        }

        public function __toString()
        {
                return 'ID:' . $this->id . '(' . $this->x . ',' . $this->y . ')';
        }

        public function serialize()
        {
                echo "\nInside " . __METHOD__ . ", $this\n\n";

                return serialize(array('y' => $this->y, 'x' => $this->x));
        }

    public function unserialize($data)
    {
                $data = unserialize($data);
                $this->x = $data['x'];
                $this->y = $data['y'];
                $this->id = self::$nextId++;

                echo "\nInside " . __METHOD__ . ", $this\n\n";
    }
}
$v_116874 = new Point($v_116872,$v_116903,);
$v_116875 = "Point $p = $v_116874\n";
$v_116876 = serialize($v_116874,);
$v_116877 = var_dump($v_116876,);
$v_116878 = '------\n';
$v_116879 = unserialize($v_116876,);

Resulted in this output:

Inside Point::__construct, ID:1(2,0)


Inside Point::serialize, ID:1(2,0)

string(88) "C:5:"Point":71:{a:2:{s:1:"y";O:13:"BcMath\Number":1:{s:5:"value";s:1:"0";}s:1:"x";i:2;}}"
/home/w023dtc/nightly_php/php-src/ext/bcmath/libbcmath/src/num2str.c:43:21: runtime error: member access within null pointer of type 'struct bc_struct'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /home/w023dtc/nightly_php/php-src/ext/bcmath/libbcmath/src/num2str.c:43:21

PHP Version

nightly

Operating System

ubuntu 20.04