From: Nikita Popov <nikita.ppv@gmail.com>
Date: Fri, 30 Oct 2020 16:23:18 +0000 (+0100)
Subject: FIxed bug #80299
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=904c1b6589b999a8e387215ac3c8fce9e4ab62a8;p=php

FIxed bug #80299

The must_wrap was leaking across iterations.
---

diff --git a/NEWS b/NEWS
index 0884c32f3f..2f45f378c1 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,10 @@ PHP                                                                        NEWS
 - Opcache:
   . Fixed run-time binding of preloaded dynamically declared function. (Dmitry)
 
+- Reflection:
+  . Fixed bug #80299 (ReflectionFunction->invokeArgs confused in arguments).
+    (Nikita)
+
 - Standard:
   . Don't force rebuild of symbol table, when populating $http_response_header
     variable by the HTTP stream wrapper. (Dmitry)
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 7572a0d890..4248212238 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -807,8 +807,8 @@ cleanup_args:
 		zval *arg;
 		uint32_t arg_num = ZEND_CALL_NUM_ARGS(call) + 1;
 		zend_bool have_named_params = 0;
-		zend_bool must_wrap = 0;
 		ZEND_HASH_FOREACH_STR_KEY_VAL(fci->named_params, name, arg) {
+			zend_bool must_wrap = 0;
 			zval *target;
 			if (name) {
 				void *cache_slot[2] = {NULL, NULL};
diff --git a/ext/reflection/tests/bug80299.phpt b/ext/reflection/tests/bug80299.phpt
new file mode 100644
index 0000000000..61aec5b1ce
--- /dev/null
+++ b/ext/reflection/tests/bug80299.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #80299: ReflectionFunction->invokeArgs confused in arguments
+--FILE--
+<?php
+
+$bar = new DateTime();
+$args = [1, &$bar];
+
+$function = function (int &$foo, DateTimeInterface &$bar) {};
+
+(new ReflectionFunction($function))->invokeArgs($args);
+
+?>
+--EXPECTF--
+Warning: {closure}(): Argument #1 ($foo) must be passed by reference, value given in %s on line %d