[php-src] master: Merge branch 'PHP-8.5'

Author: Tim Düsterhus (TimWolla)
Date: 2026-07-13T08:52:48+02:00

Commit: https://github.com/php/php-src/commit/f96f0c289aa1b79a253100692379d2615106727c
Raw diff: https://github.com/php/php-src/commit/f96f0c289aa1b79a253100692379d2615106727c.diff

Merge branch 'PHP-8.5'

* PHP-8.5:
  zend_objects: Readonly properties must be re-locked after clone-with (#22654)

Changed paths:
  A  Zend/tests/clone/clone_with_014.phpt
  M  NEWS
  M  Zend/zend_objects.c


Diff:

diff --git a/NEWS b/NEWS
index 7105b8d44f5b..b2544cb5abdf 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-15672 and GH-15911 (Stack overflow when an internal function
     recurses through zend_call_function, such as a self-attached SPL
     iterator). (iliaal)
+  . Lock unmodified readonly properties for modification after clone-with.
+    (NickSdot)
 
 - Calendar:
   . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with
diff --git a/Zend/tests/clone/clone_with_014.phpt b/Zend/tests/clone/clone_with_014.phpt
new file mode 100644
index 000000000000..bfbee40e163c
--- /dev/null
+++ b/Zend/tests/clone/clone_with_014.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Properties are still readonly after clone-with
+--FILE--
+<?php
+
+readonly class Test {
+    public public(set) int $a;
+    public public(set) int $b;
+
+    public function __construct() {
+        $this->a = 1;
+        $this->b = 2;
+    }
+}
+
+$test = clone(new Test(), ['a' => 3]);
+var_dump($test);
+
+try {
+    $test->b = 4;
+} catch (Error $e) {
+    echo $e::class, ": ", $e->getMessage(), PHP_EOL;
+}
+
+var_dump($test);
+
+?>
+--EXPECT--
+object(Test)#2 (2) {
+  ["a"]=>
+  int(3)
+  ["b"]=>
+  int(2)
+}
+Error: Cannot modify readonly property Test::$b
+object(Test)#2 (2) {
+  ["a"]=>
+  int(3)
+  ["b"]=>
+  int(2)
+}
diff --git a/Zend/zend_objects.c b/Zend/zend_objects.c
index 2fc264742cd1..474157e73d39 100644
--- a/Zend/zend_objects.c
+++ b/Zend/zend_objects.c
@@ -321,6 +321,14 @@ ZEND_API zend_object *zend_objects_clone_obj_with(zend_object *old_object, const
 		} ZEND_HASH_FOREACH_END();
 
 		EG(fake_scope) = old_scope;
+
+		/* Lock readonly properties once more. */
+		if (ZEND_CLASS_HAS_READONLY_PROPS(new_object->ce)) {
+			for (uint32_t i = 0; i < new_object->ce->default_properties_count; i++) {
+				zval* prop = OBJ_PROP_NUM(new_object, i);
+				Z_PROP_FLAG_P(prop) &= ~IS_PROP_REINITABLE;
+			}
+		}
 	}
 
 	return new_object;