Fixed bug #71336 (Wrong is_ref on properties as exposed via get_object_vars())

laruence · laruence · commit 39f09507464b · 2016-01-13T17:38:18.000+08:00
diff --git a/NEWS b/NEWS
@@ -2,10 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2016 PHP 7.0.3
 
-- Apache2handler:
-  . Fix >2G Content-Length headers in apache2handler. (Adam Harvey)
-
 - Core:
+  . Fixed bug #71336 (Wrong is_ref on properties as exposed via
+    get_object_vars()). (Laruence)
   . Fixed bug #71248 (Wrong interface is enforced). (Dmitry)
   . Fixed bug #71300 (Segfault in zend_fetch_string_offset). (Laruence)
   . Fixed bug #71221 (Null pointer deref (segfault) in get_defined_vars via
@@ -19,6 +18,9 @@ PHP                                                                        NEWS
   . Fixed bug #71297 (Memory leak with consecutive yield from). (Bob)
   . Fixed bug #71314 (var_export(INF) prints INF.0). (Andrea)
 
+- Apache2handler:
+  . Fix >2G Content-Length headers in apache2handler. (Adam Harvey)
+
 - CURL:
   . Fixed bug #71227 (Can't compile php_curl statically). (Anatol)
   . Fixed bug #71225 (curl_setopt() fails to set CURLOPT_POSTFIELDS with
diff --git a/Zend/tests/bug71336.phpt b/Zend/tests/bug71336.phpt
@@ -0,0 +1,48 @@
+--TEST--
+Bug #71336 (Wrong is_ref on properties as exposed via get_object_vars())
+--FILE--
+<?php
+class A
+{
+	protected $bar = array('baz');
+
+	function bar()
+	{
+		array_pop($this->bar);
+		$vars = get_object_vars($this);
+		$this->bar[] = array('buz');
+		print_r($vars);
+	}
+
+	function foo() {
+		array_pop($this->bar);
+		$dummy = &$this->bar;
+		$vars = get_object_vars($this);
+		$this->bar[] = array('buz');
+		print_r($vars);
+	}
+}
+
+(new A())->bar();
+(new A())->foo();
+?>
+--EXPECT--
+Array
+(
+    [bar] => Array
+        (
+        )
+
+)
+Array
+(
+    [bar] => Array
+        (
+            [0] => Array
+                (
+                    [0] => buz
+                )
+
+        )
+
+)
diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
@@ -1198,8 +1198,12 @@ ZEND_FUNCTION(get_object_vars)
 		ZEND_HASH_FOREACH_STR_KEY_VAL_IND(properties, key, value) {
 			if (key) {
 				if (zend_check_property_access(zobj, key) == SUCCESS) {
-					/* Not separating references */
-					if (Z_REFCOUNTED_P(value)) Z_ADDREF_P(value);
+					if (Z_ISREF_P(value) && Z_REFCOUNT_P(value) == 1) {
+						value = Z_REFVAL_P(value);
+					}
+					if (Z_REFCOUNTED_P(value)) {
+						Z_ADDREF_P(value);
+					}
 					if (ZSTR_VAL(key)[0] == 0) {
 						const char *prop_name, *class_name;
 						size_t prop_len;
