Fixed bug #78182

Author: nikic

NEWS

@@ -6,6 +6,8 @@ PHP NEWS
  . Fixed bug #78151 (Segfault caused by indirect expressions in PHP 7.4a1).
  (Nikita)
  . Fixed bug #78154 (SEND_VAR_NO_REF does not always send reference). (Nikita)
+ . Fixed bug #78182 (Segmentation fault during by-reference property
+ assignment). (Nikita)
 
 - Date:
  . Fixed #69044 (discrepency between time and microtime). (krakjoe)

Zend/tests/bug78182.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #78182: Segmentation fault during by-reference property assignment
+--FILE--
+<?php
+$varName = 'var';
+$propName = 'prop';
+$$varName->$propName =& $$varName;
+var_dump($var);
+?>
+--EXPECTF--
+Warning: Creating default object from empty value in %s on line %d
+object(stdClass)#1 (1) {
+ ["prop"]=>
+ *RECURSION*
+}

Zend/zend_execute.c

@@ -2826,6 +2826,7 @@ static zend_always_inline void zend_assign_to_property_reference(zval *container
 if (prop_op_type == IS_CONST) {
 prop_info = (zend_property_info *) CACHED_PTR_EX(cache_addr + 2);
 } else {
+ZVAL_DEREF(container);
 prop_info = zend_object_fetch_property_type_info(Z_OBJ_P(container), variable_ptr);
 }