From: Nicolas Grekas <nicolas.grekas@gmail.com>
Date: Tue, 16 Apr 2019 11:01:24 +0200
Subject: security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with
 side-effects from being unserialized (nicolas-grekas)

This PR was merged into the 2.8 branch.

Discussion
----------

[PHPUnit Bridge] Prevent destructors with side-effects from being unserialized

| Q             | A
| ------------- | ---
| Branch?       | 2.8
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | yes
| Fixed tickets | -
| License       | MIT
| Doc PR        | -

Commits
-------

908b64d17e [2.8][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized - CVE-2019-10912

Origin: upstream, https://github.com/symfony/symfony/commit/63eda69c32da713ab7ff5521f20fdc113880094a
---
 src/Symfony/Bridge/PhpUnit/SymfonyTestsListener.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/Symfony/Bridge/PhpUnit/SymfonyTestsListener.php b/src/Symfony/Bridge/PhpUnit/SymfonyTestsListener.php
index 24c17b8..983f17e 100644
--- a/src/Symfony/Bridge/PhpUnit/SymfonyTestsListener.php
+++ b/src/Symfony/Bridge/PhpUnit/SymfonyTestsListener.php
@@ -57,6 +57,16 @@ class SymfonyTestsListener extends \PHPUnit_Framework_BaseTestListener
         }
     }
 
+    public function __sleep()
+    {
+        throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
+    }
+
+    public function __wakeup()
+    {
+        throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
+    }
+
     public function __destruct()
     {
         if (0 < $this->state) {