diff --git a/NEWS b/NEWS index 1d5c3146da5..17abccecca3 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,8 @@ PHP NEWS . Fixed leak in Enum::from/tryFrom for internal enums when using JIT (ilutov) . Fixed calling internal methods with a static return type from extension code. (Sara) + . Fixed bug GH-8655 (Casting an object to array does not unwrap refcount=1 + references). (Nicolas Grekas) - Date: . Fixed bug #72963 (Null-byte injection in CreateFromFormat and related diff --git a/Zend/tests/bugGH-8655.phpt b/Zend/tests/bugGH-8655.phpt new file mode 100644 index 00000000000..d484c65d0e5 --- /dev/null +++ b/Zend/tests/bugGH-8655.phpt @@ -0,0 +1,29 @@ +--TEST-- +Bug GH-8655 (zval reference is not released when targetting a declared property) +--FILE-- + &$value) { + $object->$name = &$value; + } +}; + +$object = new Foo; + +hydrate(['foo' => 123], $object); + +$arrayCast = (array) $object; + +$object->foo = 234; +var_dump(ReflectionReference::fromArrayElement($arrayCast, 'foo')); +echo $arrayCast['foo']; +?> +--EXPECT-- +NULL +123 diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c index 3b0cfab1778..966ba0dd6ed 100644 --- a/Zend/zend_object_handlers.c +++ b/Zend/zend_object_handlers.c @@ -111,6 +111,10 @@ ZEND_API HashTable *zend_std_build_object_properties_array(zend_object *zobj) /* continue; } + if (Z_ISREF_P(prop) && Z_REFCOUNT_P(prop) == 1) { + prop = Z_REFVAL_P(prop); + } + Z_TRY_ADDREF_P(prop); _zend_hash_append(ht, prop_info->name, prop); }