Fix serializer bug that prevented serializer from working on any

variable that had non-reference copies of the same zval

1 files changed, 10 insertions, 3 deletions

diff --git a/ext/standard/var.c b/ext/standard/var.c
index 3fb3f2fb25..84c04ed333 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -158,14 +158,21 @@ inline int php_add_var_hash(HashTable *var_hash, zval *var, void *var_old) {
 	ulong var_no;
 	char id[sizeof(void *)*2+3];
 
-	snprintf(id,sizeof(id)-1,"%p",var);
+	snprintf(id,sizeof(id)-1, "%p", var);
 	id[sizeof(id)-1]='\0';
-	if(var_old && zend_hash_find(var_hash,id,sizeof(void *)*2,var_old) == SUCCESS) {
+
+	if(var_old && zend_hash_find(var_hash, id, sizeof(id), var_old) == SUCCESS) {
+		if(!var->is_ref) {
+			/* we still need to bump up the counter, since non-refs will
+			   be counted separately by unserializer */
+			var_no = -1;
+			zend_hash_next_index_insert(var_hash, &var_no, sizeof(var_no), NULL);
+		}
 		return FAILURE;
 	}
 	
 	var_no = zend_hash_num_elements(var_hash)+1; /* +1 because otherwise hash will think we are trying to store NULL pointer */
-	zend_hash_add(var_hash,id,sizeof(void *)*2,&var_no,sizeof(var_no),NULL);
+	zend_hash_add(var_hash, id, sizeof(id), &var_no, sizeof(var_no), NULL);
 	return SUCCESS;
 }