From: Xinchen Hui <laruence@php.net>
Date: Mon, 10 Aug 2015 09:12:33 +0000 (+0800)
Subject: Fixed bug #70223 (Incrementing value returned by magic getter)
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=aa546256e3f3ddf609f5f64ab977650a45652442;p=php

Fixed bug #70223 (Incrementing value returned by magic getter)
---

diff --git a/NEWS b/NEWS
index bd0a195fbe..e873181249 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 20 Aug 2015, PHP 7.0.0 RC 1
 
 - Core:
+  . Fixed bug #70223 (Incrementing value returned by magic getter). (Laruence)
   . Fixed bug #70215 (Segfault when __invoke is static). (Bob)
 
 - CLI server:
diff --git a/Zend/tests/bug70223.phpt b/Zend/tests/bug70223.phpt
new file mode 100644
index 0000000000..7f1633a78e
--- /dev/null
+++ b/Zend/tests/bug70223.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #70223 (Incrementing value returned by magic getter)
+--FILE--
+<?php
+
+class A {
+
+    private $foo = 0;
+
+    public function &__get($foo){ return $this->foo; }
+
+}
+
+$a = new A;
+echo $a->f++;
+echo $a->f++;
+echo $a->f++;
+?>
+--EXPECT--
+012
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index b9a7ecfe1b..090965611c 100644
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1339,14 +1339,18 @@ static zend_never_inline void zend_post_incdec_overloaded_property(zval *object,
 			}
 			ZVAL_COPY_VALUE(z, value);
 		}
-		ZVAL_COPY(result, z);
-		ZVAL_DUP(&z_copy, z);
+
+		if (UNEXPECTED(Z_TYPE_P(z) == IS_REFERENCE)) {
+			ZVAL_COPY(result, Z_REFVAL_P(z));
+		} else {
+			ZVAL_COPY(result, z);
+		}
+		ZVAL_DUP(&z_copy, result);
 		if (inc) {
 			increment_function(&z_copy);
 		} else {
 			decrement_function(&z_copy);
 		}
-		if (Z_REFCOUNTED_P(z)) Z_ADDREF_P(z);
 		Z_OBJ_HT(obj)->write_property(&obj, property, &z_copy, cache_slot);
 		OBJ_RELEASE(Z_OBJ(obj));
 		zval_ptr_dtor(&z_copy);