Fix ArrayIterator unserialize uninitialized properties HashTable

Author: arshidkv12

Zend/tests/weakrefs/gh22049.phpt

@@ -0,0 +1,22 @@
+--TEST--
+GH-22049: ArrayIterator clone after malformed unserialize should not assert
+--FILE--
+<?php
+
+$payload = 'O:13:"ArrayIterator":3:{'
+    . 's:1:"0";i:0;'
+    . 's:1:"1";a:0:{}'
+    . 's:1:"2";a:2:{i:0;i:0;i:1;i:0;}'
+    . '}';
+
+$obj = unserialize($payload);
+
+$clone = clone $obj;
+
+echo "OK\n";
+?>
+--EXPECTF--
+Deprecated: Creation of dynamic property ArrayIterator::$0 is deprecated in %s on line %d
+
+Deprecated: Creation of dynamic property ArrayIterator::$1 is deprecated in %s on line %d
+OK

Zend/zend_API.c

@@ -1778,6 +1778,13 @@ ZEND_API void object_properties_load(zend_object *object, const HashTable *prope
 					ZSTR_VAL(object->ce->name), h);
 			}
 
+			HashTable *ht = zend_std_get_properties_ex(object);
+
+			if (UNEXPECTED(HT_FLAGS(ht) & HASH_FLAG_UNINITIALIZED)) {
+				zend_hash_real_init_mixed(ht);
+				HT_FLAGS(ht) &= ~HASH_FLAG_UNINITIALIZED;
+			}
+
 			prop = zend_hash_index_update(zend_std_get_properties_ex(object), h, prop);
 			zval_add_ref(prop);
 		}