Commit 262865195d3 for php.net

commit 262865195d327c80a54c760e67ce35398f85ca79
Author: Tim Düsterhus <tim@bastelstu.be>
Date:   Tue Sep 22 19:01:58 2026 +0200

    standard: Pass `unserialize('')` through the regular path (#23827)

    Previously `unserialize()` with an empty string as input was handled specially,
    returning `false` (indicating an error), but without emitting an associated
    warning. We can just pass it through the regular path, which will also return
    `false` (including the warning) and will also avoid a check that is almost
    never taken in practice.

    Fixes php/php-src#23780.

diff --git a/NEWS b/NEWS
index 21b34cf655f..5bac8f9cb13 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,9 @@ PHP                                                                        NEWS
   . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD
     request for a static file). (jakubskopal)

+- Standard:
+  . Fixed bug GH-23780 (unserialize('') fails silently). (timwolla)
+
 24 Sep 2026, PHP 8.6.0RC1

 - Core:
diff --git a/ext/opcache/tests/jit/assign_048.phpt b/ext/opcache/tests/jit/assign_048.phpt
index ed7a058d862..bce0fdbe67f 100644
--- a/ext/opcache/tests/jit/assign_048.phpt
+++ b/ext/opcache/tests/jit/assign_048.phpt
@@ -20,23 +20,43 @@ function test(){
 ?>
 DONE
 --EXPECTF--
+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7

+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+
 Warning: Undefined variable $a in %sassign_048.php on line 7
 DONE
diff --git a/ext/standard/tests/serialize/gh23780.phpt b/ext/standard/tests/serialize/gh23780.phpt
new file mode 100644
index 00000000000..daaf3029f21
--- /dev/null
+++ b/ext/standard/tests/serialize/gh23780.phpt
@@ -0,0 +1,9 @@
+--TEST--
+GH-23780: unserialize('') fails silently
+--FILE--
+<?php
+var_dump(unserialize(''));
+?>
+--EXPECTF--
+Warning: unserialize(): Error at offset 0 of 0 bytes in %s on line %d
+bool(false)
diff --git a/ext/standard/var.c b/ext/standard/var.c
index f94c1cf0958..7b868afddd2 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -1411,10 +1411,6 @@ PHPAPI void php_unserialize_with_options(zval *return_value, const char *buf, co
 	HashTable *class_hash = NULL, *prev_class_hash;
 	zend_long prev_max_depth, prev_cur_depth;

-	if (buf_len == 0) {
-		RETURN_FALSE;
-	}
-
 	p = (const unsigned char*) buf;
 	PHP_VAR_UNSERIALIZE_INIT(var_hash);