I'm not sure why this helps - can't somebody from php_var_unserialize change array as well via reference?

i)

```
SPL_METHOD(Array, unserialize)
{
...
		if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)
				|| (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) {
			zval_ptr_dtor(&intern->array); <=== call to zval_ptr_dtor
			goto outexcept;
```

if php_var_unserialize() call fails, the `&intern->array` will be freed via zval_ptr_dtor().

```
	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) spl_array_object_free_storage, NULL TSRMLS_CC);
```

then call to spl_array_object_free_storage in during object destruction.

```
static void spl_array_object_free_storage(void *object TSRMLS_DC)
{
...
	zval_ptr_dtor(&intern->array); <=== call to zval_ptr_dtor again
```

the `&intern->array` will be freed again via zval_ptr_dtor(), this results in use-after-free/double-free.

ii)

```
static void spl_array_object_free_storage(void *object TSRMLS_DC)
{
	efree(object); <=== free memory
...
SPL_METHOD(Array, unserialize)
{
...
		if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)
				|| (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) {
			zval_ptr_dtor(&intern->array); <=== use freed memory
			goto outexcept;
```

the CURLFile::__wakeup lead to object was freed from the memory, then call to zval_ptr_dtor handles `&intern->array`, this results in use-after-free/double-free.

so my solution used the `&array` instead of the `&intern->array`, and the solution can only solve this issue.

Looks like just deleting zval_ptr_dtor(&intern->array); also fixes it and does not add any new memory leaks, so I'm inclined to do that instead.

The fix is in security repo as 504ff0629f7ce8c0d4fc001673e6600f98b31e28 and in https://gist.github.com/38c86428a3a96df054223246ec7b936b

please verify

The patch can fix this bug in 5.6, but I think the bug can be still triggered in 7.0 with special __wakeup(). You shouldn't use `&intern->array` in during call to php_var_unserialize.

Could you post the code for 7.0? Even better, submit is as a separate issue?

You can test the second example in the original report, just need to used a special __wakeup() instead of the CURLFile::__wakeup().

I'm not sure I understand what "special wakeup" means. Please provide the code you were using, so we are sure we're talking about the same thing.

```
<?php

class obj {
  var $ryat;
  function __wakeup() {
    $this->ryat = NULL;
    throw new Exception("Not a serializable object");
  }
}

$inner = 'x:i:1;O:3:"obj":1:{s:4:"ryat";R:1;};m:a:0:{}';
$exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}';
unserialize($exploit);

?>
```

Another way to trigger the bug

```
<?php

class obj {
	var $ryat;
	function __wakeup() {
		$this->ryat = NULL;
	}
}

$inner = 'x:i:1;O:3:"obj":1:{s:4:"ryat";R:2;};m:a:0:{}';
$exploit = 'a:2:{i:0;C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
$data = unserialize($exploit);
var_dump($data);

?>
```

Fix:
```
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index fe38735..0bb018f 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -1740,7 +1740,7 @@ SPL_METHOD(Array, unserialize)
 	size_t buf_len;
 	const unsigned char *p, *s;
 	php_unserialize_data_t var_hash;
-	zval *members, *zflags;
+	zval *members, *zflags, *array;
 	zend_long flags;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &buf, &buf_len) == FAILURE) {
@@ -1790,11 +1790,12 @@ SPL_METHOD(Array, unserialize)
 		intern->ar_flags |= flags & SPL_ARRAY_CLONE_MASK;
 		zval_ptr_dtor(&intern->array);
 		ZVAL_UNDEF(&intern->array);
-		if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash)
-				|| (Z_TYPE(intern->array) != IS_ARRAY && Z_TYPE(intern->array) != IS_OBJECT)) {
+		array = var_tmp_var(&var_hash);
+		if (!php_var_unserialize(array, &p, s + buf_len, &var_hash)
+				|| (Z_TYPE_P(array) != IS_ARRAY && Z_TYPE_P(array) != IS_OBJECT)) {
 			goto outexcept;
 		}
-		var_push_dtor(&var_hash, &intern->array);
+		ZVAL_COPY(&intern->array, array);
 	}
 	if (*p != ';') {
 		goto outexcept;
```

BTW, the above patch can only fix the issue of the `&intern->array` being freed in during call to the php_var_unserialize, can't fix the issue of the `ArrayObject` being freed.

This sounds like different, already existing, but report. In any case, please report different issues in different version separately, it's impossible to track several issues in one bug report.

I know, but I don't like to report some similar issues separately, preferring to point out the some typical issues in the same type of issues, and I don't intend to repeat report some new issues in unserialize with __wakeup, since we still haven't a solution.

The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.

Looks like this is fixed by Nikita's __wakeup patch