From ed8d1ba7dd3f37e60fbd9520ff35986d5c946812 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Fri, 29 May 2015 13:50:44 +0800
Subject: [PATCH] Fixed bug #69723 (Passing parameters by reference and
 array_column)

---
 NEWS                                   |  2 ++
 ext/standard/array.c                   |  1 +
 ext/standard/tests/array/bug69723.phpt | 40 ++++++++++++++++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 ext/standard/tests/array/bug69723.phpt

diff --git a/NEWS b/NEWS
index 6ae7dc1a2a..0e1a14b973 100644
--- a/NEWS
+++ b/NEWS
@@ -209,6 +209,8 @@
     required_num_args). (Julien)
 
 - Standard:
+  . Fixed bug #69723 (Passing parameters by reference and array_column).
+    (Laruence)
   . Fixed bug #69523 (Cookie name cannot be empty). (Christoph M. Becker)
   . Fixed bug #69325 (php_copy_file_ex does not pass the argument).
     (imbolk at gmail dot com)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 3397de923b..519b665df0 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -3061,6 +3061,7 @@ PHP_FUNCTION(array_column)
 
 	array_init(return_value);
 	ZEND_HASH_FOREACH_VAL(arr_hash, data) {
+		ZVAL_DEREF(data);
 		if (Z_TYPE_P(data) != IS_ARRAY) {
 			/* Skip elemens which are not sub-arrays */
 			continue;
diff --git a/ext/standard/tests/array/bug69723.phpt b/ext/standard/tests/array/bug69723.phpt
new file mode 100644
index 0000000000..23b3576a51
--- /dev/null
+++ b/ext/standard/tests/array/bug69723.phpt
@@ -0,0 +1,40 @@
+--TEST--
+Bug #69723 (Passing parameters by reference and array_column)
+--FILE--
+<?php
+function byReference( & $array){
+	foreach($array as &$item){
+		$item['nanana'] = 'batman';
+		$item['superhero'] = 'robin';
+	}
+}
+
+$array = [
+	[
+	'superhero'=> 'superman',
+	'nanana' => 'no nana'
+	],
+	[
+	'superhero'=> 'acuaman',
+	'nanana' => 'no nana'
+	],
+
+	];
+
+var_dump(array_column($array, 'superhero'));
+byReference($array);
+var_dump(array_column($array, 'superhero'));
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  string(8) "superman"
+  [1]=>
+  string(7) "acuaman"
+}
+array(2) {
+  [0]=>
+  string(5) "robin"
+  [1]=>
+  string(5) "robin"
+}
-- 
2.50.1