PHPC-2456: Correctly dereference arrays in type maps

Author: alcaeus

src/contrib/php_array_api.h

@@ -420,7 +420,17 @@ char *php_array_zval_to_string(zval *z, int *plen, zend_bool *pfree) {
  * zval *php_array_fetchz_array(zval *zarr, zval *key)
  */
 static inline zval *php_array_zval_to_array(zval *zarr) {
-	return (zarr && (Z_TYPE_P(zarr) == IS_ARRAY)) ? zarr : NULL;
+try_again:
+	if (!zarr) { return NULL; }
+	switch (Z_TYPE_P(zarr)) {
+		case IS_REFERENCE:
+			ZVAL_DEREF(zarr);
+			goto try_again;
+		case IS_ARRAY:
+			return zarr;
+		default:
+			return NULL;
+	}
 }
 PHP_ARRAY_FETCH_TYPE_MAP(zval*, array)
 #define php_array_fetchc_array(zarr, litstr) \
@@ -493,8 +503,17 @@ void *php_array_zval_to_resource(zval *z, int le) {
  */
 static inline
 zval *php_array_zval_to_object(zval *z, zend_class_entry *ce) {
-	return (z && (Z_TYPE_P(z) == IS_OBJECT) &&
-	        ((!ce) || instanceof_function(Z_OBJCE_P(z), ce))) ? z : NULL;
+try_again:
+	if (!z) { return NULL; }
+	switch (Z_TYPE_P(z)) {
+		case IS_REFERENCE:
+			ZVAL_DEREF(z);
+			goto try_again;
+		case IS_OBJECT:
+			return (!ce) || instanceof_function(Z_OBJCE_P(z), ce) ? z : NULL;
+		default:
+			return NULL;
+	}
 }
 #define php_array_fetch_object(zarr, key, ce) \
 	php_array_zval_to_object(php_array_fetch(zarr, key), ce)

tests/bson/bug2456-001.phpt

@@ -0,0 +1,25 @@
+--TEST--
+PHPC-2456: References passed in a typeMap
+--FILE--
+<?php
+require_once __DIR__ . "/../utils/basic.inc";
+
+$fieldPaths = [];
+
+$typeMap = ['fieldPaths' => &$fieldPaths];
+
+var_dump(MongoDB\BSON\Document::fromPHP([])->toPHP($typeMap));
+var_dump(MongoDB\BSON\PackedArray::fromPHP([])->toPHP($typeMap));
+var_dump(MongoDB\BSON\toPHP(MongoDB\BSON\fromPHP([]), $typeMap));
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+object(stdClass)#%d (0) {
+}
+array(0) {
+}
+object(stdClass)#%d (0) {
+}
+===DONE===