Fixed bug #76366 (references in sub-array for filtering breaks the filter)

2 files changed, 43 insertions, 0 deletions

diff --git a/ext/filter/filter.c b/ext/filter/filter.c
index a4ca1e0a99..5a34caaa24 100644
--- a/ext/filter/filter.c
+++ b/ext/filter/filter.c
@@ -621,6 +621,9 @@ static void php_filter_call(zval *filtered, zend_long filter, zval *filter_args,
 		}
 
 		if ((option = zend_hash_str_find(HASH_OF(filter_args), "options", sizeof("options") - 1)) != NULL) {
+			/* avoid reference type */
+			ZVAL_DEREF(option);
+
 			if (filter != FILTER_CALLBACK) {
 				if (Z_TYPE_P(option) == IS_ARRAY) {
 					options = option;
diff --git a/ext/filter/tests/bug76366.phpt b/ext/filter/tests/bug76366.phpt
new file mode 100644
index 0000000000..56cbb9db54
--- /dev/null
+++ b/ext/filter/tests/bug76366.phpt
@@ -0,0 +1,40 @@
+--TEST--
+Bug #76366 (references in sub-array for filtering breaks the filter)
+--SKIPIF--
+<?php
+if (!extension_loaded('filter')) die('skip filter extension not available');
+?>
+--FILE--
+<?php
+
+#array to filter
+$data = ['foo' => 6];
+
+#filter args
+$args = [
+    'foo'=> [
+        'filter' => FILTER_VALIDATE_INT,
+        'flags' => FILTER_FORCE_ARRAY
+    ]
+];
+
+$args['foo']['options'] = [];
+
+#create reference
+$options = &$args['foo']['options'];
+
+#set options
+$options['min_range'] = 1;
+$options['max_range'] = 5;
+
+#show the filter result
+var_dump(filter_var_array($data, $args));
+?>
+--EXPECT--
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    bool(false)
+  }
+}