Fixed bug #71617

NEWS

@@ -15,6 +15,10 @@ PHP                                                                        NEWS
 - phpdbg:
   . Fixed crash when advancing (except step) inside an internal function. (Bob)
 
+- SPL:
+  . Fixed bug #71617 (private properties lost when unserializing ArrayObject).
+    (Nikita)
+
 ?? Mar 2016 PHP 7.0.4
 
 - Core:

Zend/zend_API.c

@@ -1226,8 +1226,15 @@ ZEND_API void object_properties_load(zend_object *object, HashTable *properties)
 				size_t prop_name_len;
 				if (zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_name_len) == SUCCESS) {
 					zend_string *pname = zend_string_init(prop_name, prop_name_len, 0);
+					zend_class_entry *prev_scope = EG(scope);
+					if (class_name && class_name[0] != '*') {
+						zend_string *cname = zend_string_init(class_name, strlen(class_name), 0);
+						EG(scope) = zend_lookup_class(cname);
+						zend_string_release(cname);
+					}
 					property_info = zend_get_property_info(object->ce, pname, 1);
 					zend_string_release(pname);
+					EG(scope) = prev_scope;
 				} else {
 					property_info = ZEND_WRONG_PROPERTY_INFO;
 				}

ext/spl/tests/bug71617.phpt

@@ -0,0 +1,50 @@
+--TEST--
+Bug #71617: private properties lost when unserializing ArrayObject
+--FILE--
+<?php
+
+class Test extends ArrayObject
+{
+
+	private $name = null;
+
+	public function __construct(array $input)
+	{
+		parent::__construct($input, ArrayObject::ARRAY_AS_PROPS);
+	}
+
+	public function setName($name)
+	{
+		$this->name = $name;
+		return $this;
+	}
+
+	public function getName()
+	{
+		return $this->name;
+	}
+}
+
+$test = new Test(['a' => 'a', 'b' => 'b']);
+$test->setName('ok');
+
+$ser = serialize($test);
+$unSer = unserialize($ser);
+
+var_dump($unSer->getName());
+var_dump($unSer);
+
+?>
+--EXPECT--
+string(2) "ok"
+object(Test)#2 (2) {
+  ["name":"Test":private]=>
+  string(2) "ok"
+  ["storage":"ArrayObject":private]=>
+  array(2) {
+    ["a"]=>
+    string(1) "a"
+    ["b"]=>
+    string(1) "b"
+  }
+}