From: Nikita Popov <nikita.ppv@gmail.com>
Date: Thu, 2 Jan 2020 09:52:50 +0000 (+0100)
Subject: Deref names returned by __sleep()
X-Git-Tag: php-7.4.7RC1~354
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=de0ca4734e2e8b19fabe06027439ceb81ea2eb13;p=php

Deref names returned by __sleep()
---

diff --git a/ext/standard/tests/serialize/sleep_deref.phpt b/ext/standard/tests/serialize/sleep_deref.phpt
new file mode 100644
index 0000000000..36777db0a3
--- /dev/null
+++ b/ext/standard/tests/serialize/sleep_deref.phpt
@@ -0,0 +1,18 @@
+--TEST--
+__sleep() can return references
+--FILE--
+<?php
+
+class Test {
+    public $x = 42;
+    public function __sleep() {
+        $name = 'x';
+        return [&$name];
+    }
+}
+
+var_dump(serialize(new Test));
+
+?>
+--EXPECT--
+string(28) "O:4:"Test":1:{s:1:"x";i:42;}"
diff --git a/ext/standard/var.c b/ext/standard/var.c
index a2eb471d54..aafc35e8bf 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -778,6 +778,7 @@ static void php_var_serialize_collect_names(HashTable *ht, HashTable *src) /* {{
 
 	zend_hash_init(ht, zend_hash_num_elements(src), NULL, NULL, 0);
 	ZEND_HASH_FOREACH_VAL(src, val) {
+		ZVAL_DEREF(val);
 		if (Z_TYPE_P(val) != IS_STRING) {
 			php_error_docref(NULL, E_NOTICE,
 					"__sleep should return an array only containing the names of instance-variables to serialize.");