From 79a36ff7f33194cf08ebe511bd828e1cdaea8e41 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikita.ppv@gmail.com>
Date: Wed, 15 Apr 2020 11:20:33 +0200
Subject: Fixed bug #79477

Make sure to deindirect properties when creating array.
---
 NEWS                     |  1 +
 Zend/tests/bug79477.phpt | 20 ++++++++++++++++++++
 Zend/zend_hash.c         |  2 +-
 3 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/bug79477.phpt

diff --git a/NEWS b/NEWS
index b7ded38bf1..adbaf6223e 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference
     on !CS constant). (Nikita)
+  . Fixed bug #79477 (casting object into array creates references). (Nikita)
 
 - DOM:
   . Fixed bug #78221 (DOMNode::normalize() doesn't remove empty text nodes).
diff --git a/Zend/tests/bug79477.phpt b/Zend/tests/bug79477.phpt
new file mode 100644
index 0000000000..cb5340d104
--- /dev/null
+++ b/Zend/tests/bug79477.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79477: casting object into array creates references
+--FILE--
+<?php
+
+class Test {
+	public $prop = 'default value';
+}
+
+$obj = new Test;
+$obj->{1} = null;
+
+$arr = (array) $obj;
+$arr['prop'] = 'new value';
+
+echo $obj->prop, "\n";
+
+?>
+--EXPECT--
+default value
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 6fc4666da9..16fd24e3dc 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -2722,7 +2722,7 @@ convert:
 	{
 		HashTable *new_ht = zend_new_array(zend_hash_num_elements(ht));
 
-		ZEND_HASH_FOREACH_KEY_VAL(ht, num_key, str_key, zv) {
+		ZEND_HASH_FOREACH_KEY_VAL_IND(ht, num_key, str_key, zv) {
 			do {
 				if (Z_OPT_REFCOUNTED_P(zv)) {
 					if (Z_ISREF_P(zv) && Z_REFCOUNT_P(zv) == 1) {
-- 
cgit v1.2.1