Fixed bug #79477

Make sure to deindirect properties when creating array.

diff --git a/NEWS b/NEWS
index b7ded38bf1b98bc3ff86c8c1436447e313c8e997..adbaf6223e56c0bec2e1082f1713dc870da30194 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference
     on !CS constant). (Nikita)
+  . Fixed bug #79477 (casting object into array creates references). (Nikita)
 
 - DOM:
   . Fixed bug #78221 (DOMNode::normalize() doesn't remove empty text nodes).

diff --git a/Zend/tests/bug79477.phpt b/Zend/tests/bug79477.phpt
new file mode 100644 (file)
index 0000000..cb5340d
--- /dev/null
+++ b/Zend/tests/bug79477.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79477: casting object into array creates references
+--FILE--
+<?php
+
+class Test {
+       public $prop = 'default value';
+}
+
+$obj = new Test;
+$obj->{1} = null;
+
+$arr = (array) $obj;
+$arr['prop'] = 'new value';
+
+echo $obj->prop, "\n";
+
+?>
+--EXPECT--
+default value

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 6fc4666da9ae2e499bcddf358e6c155813009e73..16fd24e3dc28c6f8129501548d718355ed9b0eae 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -2722,7 +2722,7 @@ convert:
        {
                HashTable *new_ht = zend_new_array(zend_hash_num_elements(ht));
 
-               ZEND_HASH_FOREACH_KEY_VAL(ht, num_key, str_key, zv) {
+               ZEND_HASH_FOREACH_KEY_VAL_IND(ht, num_key, str_key, zv) {
                        do {
                                if (Z_OPT_REFCOUNTED_P(zv)) {
                                        if (Z_ISREF_P(zv) && Z_REFCOUNT_P(zv) == 1) {