zend_objects: Disallow clone_with by reference

Author: TimWolla

Zend/tests/clone/clone_with_013.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Clone with references
+--FILE--
+<?php
+
+$x = new stdClass();
+
+$ref = 'reference';
+$with = ['x' => &$ref];
+
+try {
+	var_dump(clone($x, $with));
+} catch (Throwable $e) {
+	echo $e::class, ": ", $e->getMessage(), PHP_EOL;
+}
+
+unset($ref);
+
+try {
+	var_dump(clone($x, $with));
+} catch (Throwable $e) {
+	echo $e::class, ": ", $e->getMessage(), PHP_EOL;
+}
+
+?>
+--EXPECTF--
+Error: Cannot assign by reference when cloning with updated properties
+object(stdClass)#%d (1) {
+  ["x"]=>
+  string(9) "reference"
+}

Zend/zend_objects.c

@@ -294,6 +294,15 @@ ZEND_API zend_object *zend_objects_clone_obj_with(zend_object *old_object, const
 		EG(fake_scope) = scope;
 
 		ZEND_HASH_FOREACH_KEY_VAL(properties, zend_ulong num_key, zend_string *key, zval *val) {
+			if (UNEXPECTED(Z_ISREF_P(val))) {
+				if (Z_REFCOUNT_P(val) == 1) {
+					val = Z_REFVAL_P(val);
+				} else {
+					zend_throw_error(NULL, "Cannot assign by reference when cloning with updated properties");
+					break;
+				}
+			}
+
 			if (UNEXPECTED(key == NULL)) {
 				key = zend_long_to_str(num_key);
 				new_object->handlers->write_property(new_object, key, val, NULL);