Fix memory corruption when unpacking unknown enum

msgpack_unpack.c

@@ -692,6 +692,26 @@ int msgpack_unserialize_map_item(msgpack_unpack_data *unpack, zval **container,
                         __FUNCTION__, Z_STRVAL_P(key));
 #else
                     ce = msgpack_unserialize_class(container, Z_STR_P(key), 0);
+                    /* Enums are not allowed to implement Serializable nor __unserialize */
+                    if (ce == NULL || ce == PHP_IC_ENTRY) {
+                        MSGPACK_WARNING(
+                            "[msgpack] (%s) Enum definition %s could not be loaded",
+                            __FUNCTION__, Z_STRVAL_P(key));
+
+                        MSGPACK_UNSERIALIZE_FINISH_MAP_ITEM(unpack, key, val);
+                        return 0;
+                    }
+
+                    /* found class is not an Enum but a normal Class */
+                    if (!(ce->ce_flags & ZEND_ACC_ENUM)) {
+                        MSGPACK_WARNING(
+                            "[msgpack] (%s) Class %s is expected to be an Enum",
+                            __FUNCTION__, ZSTR_VAL(ce->name));
+
+                        MSGPACK_UNSERIALIZE_FINISH_MAP_ITEM(unpack, key, val);
+                        return 0;
+                    }
+
                     zend_object *enum_instance = zend_enum_get_case(ce, Z_STR_P(val));
                     ZVAL_OBJ(*container, enum_instance);
 #endif

tests/enum002.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Enums
+--SKIPIF--
+<?php
+if (!extension_loaded("msgpack")) {
+    exit('skip because msgpack extension is missing');
+}
+if (version_compare(PHP_VERSION, '8.1.0', '<')) {
+    exit('skip Enum tests in PHP older than 8.1.0');
+}
+?>
+--FILE--
+<?php
+$unpacked = msgpack_unpack(file_get_contents(__DIR__."/enum002.ser.txt"));
+var_dump($unpacked);
+?>
+DONE
+--EXPECTF--
+Warning: [msgpack] (msgpack_unserialize_map_item) Enum definition test\TestEnum could not be loaded in %senum002.php on line 2
+array(1) {
+  ["enum"]=>
+  object(__PHP_Incomplete_Class)#1 (1) {
+    ["__PHP_Incomplete_Class_Name"]=>
+    string(13) "test\TestEnum"
+  }
+}
+DONE

tests/enum002.ser.txt

@@ -0,0 +1 @@
+¤enum‚À­test\TestEnum¡A

tests/enum003.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Enums
+--SKIPIF--
+<?php
+if (!extension_loaded("msgpack")) {
+    exit('skip because msgpack extension is missing');
+}
+if (version_compare(PHP_VERSION, '8.1.0', '<')) {
+    exit('skip Enum tests in PHP older than 8.1.0');
+}
+if (defined("PHP_DEBUG") && PHP_DEBUG) {
+    die('skip debug build');
+}
+?>
+--FILE--
+<?php
+namespace test;
+
+class TestEnum {
+
+}
+
+$unpacked = msgpack_unpack(file_get_contents(__DIR__."/enum002.ser.txt"));
+var_dump($unpacked);
+?>
+DONE
+--EXPECTF--
+Warning: [msgpack] (msgpack_unserialize_map_item) Class test\TestEnum is expected to be an Enum in %senum003.php on line 8
+array(1) {
+  ["enum"]=>
+  NULL
+}
+DONE