fix bug #64146 (serialize incorrectly saving objects when they are

cloned)

diff --git a/ext/standard/tests/serialize/bug64146.phpt b/ext/standard/tests/serialize/bug64146.phpt
new file mode 100644 (file)
index 0000000..18ae78d
--- /dev/null
+++ b/ext/standard/tests/serialize/bug64146.phpt
@@ -0,0 +1,60 @@
+--TEST--
+Bug #64146 (serialize incorrectly saving objects when they are cloned)
+--FILE--
+<?php
+
+echo "Test\n";
+
+class A
+{
+    public $a = array();
+
+    public function __construct()
+    {
+        $this->a[] = new B(1);
+        $this->a[] = new B(2);
+    }
+}
+
+class B implements Serializable
+{
+    public $b;
+
+    public function __construct($c)
+    {
+        $this->b = new C($c);
+    }
+
+    public function serialize()
+    {
+        return serialize(clone $this->b);
+    }
+
+    public function unserialize($data)
+    {
+        $this->b = unserialize($data);
+    }
+}
+
+class C
+{
+    public $c;
+
+    public function __construct($c)
+    {
+        $this->c = $c;
+    }
+}
+
+$a = unserialize(serialize(new A()));
+
+print $a->a[0]->b->c . "\n";
+print $a->a[1]->b->c . "\n";
+
+?>
+Done
+--EXPECT--
+Test
+1
+2
+Done

diff --git a/ext/standard/var.c b/ext/standard/var.c
index f76a14cfa66410880fd2208f50d766a3de7ddfbe..f71c4a4fdc3e81db8bac4c09407c9cb2be6ba35a 100644 (file)
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -549,11 +549,9 @@ static inline int php_add_var_hash(HashTable *var_hash, zval *var, void *var_old
        char id[32], *p;
        register int len;
 
-       /* relies on "(long)" being a perfect hash function for data pointers,
-        * however the actual identity of an object has had to be determined
-        * by its object handle since 5.0. */
        if ((Z_TYPE_P(var) == IS_OBJECT) && Z_OBJ_HT_P(var)->get_class_entry) {
-               p = smart_str_print_long(id + sizeof(id) - 1, (long) Z_OBJ_HANDLE_P(var));
+               p = smart_str_print_long(id + sizeof(id) - 1,
+                               (long) zend_objects_get_address(var TSRMLS_CC));
                *(--p) = 'O';
                len = id + sizeof(id) - 1 - p;
        } else {