[PHP-CVS] [php-src] master: serializer: must duplicate unserialize_callback_func global zstr

Author: Gina Peter Banyard (Girgias)
Date: 2026-07-31T10:53:48+01:00

Commit: https://github.com/php/php-src/commit/79d76a560a5f646881dc45a4b1b76332304e345f
Raw diff: https://github.com/php/php-src/commit/79d76a560a5f646881dc45a4b1b76332304e345f.diff

serializer: must duplicate unserialize_callback_func global zstr

Changed paths:
  M  ext/standard/var_unserializer.re


Diff:

diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
index 458ad2f12baa..27647c907d3a 100644
--- a/ext/standard/var_unserializer.re
+++ b/ext/standard/var_unserializer.re
@@ -1256,7 +1256,7 @@ object ":" uiv ":" ["]	{
 		}
 
 		/* Call unserialize callback */
-		ZVAL_STR_COPY(&user_func, PG(unserialize_callback_func));
+		ZVAL_STR(&user_func, zend_string_dup(PG(unserialize_callback_func), false));
 
 		ZVAL_STR(&args[0], class_name);
 		BG(serialize_lock)++;