Make unserialize() ref unwrapping compatible with 7.0

Also fix output difference in merged test (unrelated).

1 files changed, 7 insertions, 1 deletions

diff --git a/ext/standard/var.c b/ext/standard/var.c
index 490a68c175..03368287d7 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -1118,7 +1118,6 @@ PHP_FUNCTION(unserialize)
 		}
 		RETVAL_FALSE;
 	} else {
-		ZVAL_DEREF(retval);
 		ZVAL_COPY(return_value, retval);
 	}
 
@@ -1130,6 +1129,13 @@ PHP_FUNCTION(unserialize)
 	/* Reset to previous allowed_classes in case this is a nested call */
 	php_var_unserialize_set_allowed_classes(var_hash, prev_class_hash);
 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
+
+	/* Per calling convention we must not return a reference here, so unwrap. We're doing this at
+	 * the very end, because __wakeup() calls performed during UNSERIALIZE_DESTROY might affect
+	 * the value we unwrap here. This is compatible with behavior in PHP <=7.0. */
+	if (Z_ISREF_P(return_value)) {
+		zend_unwrap_reference(return_value);
+	}
 }
 /* }}} */