ext/reflection: fix bug 20873 - cannot assign by reference to overloaded object

Author: arshidkv12

Zend/zend_execute.c

@@ -3624,6 +3624,15 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
 			ZVAL_ERROR(result);
 			goto end;
 		}
+		if (UNEXPECTED(!Z_REFCOUNTED_P(ptr) && !Z_ISREF_P(ptr) && Z_TYPE_P(ptr) != IS_INDIRECT )) {
+			if (Z_TYPE_P(ptr) == IS_FALSE) {
+				ZVAL_FALSE(result);
+			} 
+			if (Z_TYPE_P(ptr) == IS_NULL) {
+				ZVAL_NULL(result);
+			} 
+			goto end;
+		}
 	} else if (UNEXPECTED(Z_ISERROR_P(ptr))) {
 		ZVAL_ERROR(result);
 		goto end;

ext/reflection/tests/bug20873.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Lazy proxy with __get creating references and arithmetic
+--FILE--
+<?php
+class A {
+    public $_;
+
+    public function __get($n) {
+        global $obj;
+
+        // Create a reference to an uninitialized property
+        $obj->x =& $this->_;
+
+        // Static self-reference (edge case)
+        static $a = $a;
+
+        // Arithmetic on reference
+        $e =& $this->_ - $a;
+    }
+}
+
+$rc = new ReflectionClass(A::class);
+$obj = $rc->newLazyProxy(fn() => new A);
+$rc->initializeLazyObject($obj);
+
+var_dump($obj->p);
+?>
+--EXPECTF--
+Deprecated: Creation of dynamic property A::$x is deprecated in %s on line %d
+
+Warning: Undefined property: A::$x in %s on line %d
+
+Fatal error: Uncaught Error: Cannot assign by reference to overloaded object in %s:%d
+Stack trace:
+#0 %s(9): A->__get('x')
+#1 %s(23): A->__get('p')
+#2 {main}
+  thrown in %s on line %d
+
+