From bc59b046c6128a42857551da12f07005d56190ed Mon Sep 17 00:00:00 2001
From: Joe Watkins <krakjoe@php.net>
Date: Fri, 18 Jun 2021 11:01:54 +0200
Subject: [PATCH] Fix bug #81163 indirect vars in __sleep

---
 NEWS                                       |  2 ++
 ext/standard/tests/serialize/bug81163.phpt | 22 ++++++++++++++++++++++
 ext/standard/var.c                         |  2 +-
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/serialize/bug81163.phpt

diff --git a/NEWS b/NEWS
index fcbc083fe9c..37f9a6b41ce 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #81145 (copy() and stream_copy_to_stream() fail for +4GB files).
     (cmb, Nikita)
+  . Fixed bug #81163 (incorrect handling of indirect vars in __sleep).
+    (krakjoe)
 
 - Intl:
   . Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).
diff --git a/ext/standard/tests/serialize/bug81163.phpt b/ext/standard/tests/serialize/bug81163.phpt
new file mode 100644
index 00000000000..5acca2a0461
--- /dev/null
+++ b/ext/standard/tests/serialize/bug81163.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Test __sleep returns non-array
+--FILE--
+<?php
+class foo
+{
+    private $private = 'private';
+}
+
+class bar extends foo
+{
+    public function __sleep()
+    {
+        return (new bar());
+    }
+}
+
+serialize(new bar());
+?>
+--EXPECTF--
+Notice: serialize(): "private" returned as member variable from __sleep() but does not exist in %s on line %d
+
diff --git a/ext/standard/var.c b/ext/standard/var.c
index 98efdcc7f34..37a68bbaa1c 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -825,7 +825,7 @@ static int php_var_serialize_get_sleep_props(
 	zend_hash_init(ht, zend_hash_num_elements(sleep_retval), NULL, ZVAL_PTR_DTOR, 0);
 	/* TODO: Rewrite this by fetching the property info instead of trying out different
 	 * name manglings? */
-	ZEND_HASH_FOREACH_VAL(sleep_retval, name_val) {
+	ZEND_HASH_FOREACH_VAL_IND(sleep_retval, name_val) {
 		zend_string *name, *tmp_name, *priv_name, *prot_name;
 
 		ZVAL_DEREF(name_val);