Fix bug #81163 indirect vars in __sleep

Author: krakjoe

NEWS

@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #81145 (copy() and stream_copy_to_stream() fail for +4GB files).
     (cmb, Nikita)
+  . Fixed bug #81163 (incorrect handling of indirect vars in __sleep).
+    (krakjoe)
 
 - Intl:
   . Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).

ext/standard/tests/serialize/bug81163.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Test __sleep returns non-array
+--FILE--
+<?php
+class foo
+{
+    private $private = 'private';
+}
+
+class bar extends foo
+{
+    public function __sleep()
+    {
+        return (new bar());
+    }
+}
+
+serialize(new bar());
+?>
+--EXPECTF--
+Notice: serialize(): "private" returned as member variable from __sleep() but does not exist in %s on line %d
+

ext/standard/var.c

@@ -825,7 +825,7 @@ static int php_var_serialize_get_sleep_props(
 	zend_hash_init(ht, zend_hash_num_elements(sleep_retval), NULL, ZVAL_PTR_DTOR, 0);
 	/* TODO: Rewrite this by fetching the property info instead of trying out different
 	 * name manglings? */
-	ZEND_HASH_FOREACH_VAL(sleep_retval, name_val) {
+	ZEND_HASH_FOREACH_VAL_IND(sleep_retval, name_val) {
 		zend_string *name, *tmp_name, *priv_name, *prot_name;
 
 		ZVAL_DEREF(name_val);