zend_objects: Disallow clone_with by reference

Author: TimWolla

Zend/tests/clone/clone_with_013.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Clone with references
+--FILE--
+<?php
+
+$x = new stdClass();
+
+try {
+	$ref = 'reference';
+	var_dump(clone($x, ['x' => &$ref]));
+} catch (Throwable $e) {
+	echo $e::class, ": ", $e->getMessage(), PHP_EOL;
+}
+
+?>
+--EXPECT--
+Error: Cannot assign by reference when cloning with updated properties

Zend/zend_objects.c

@@ -297,6 +297,11 @@ ZEND_API zend_object *zend_objects_clone_obj_with(zend_object *old_object, const
 		zend_string *key;
 		zval *val;
 		ZEND_HASH_FOREACH_KEY_VAL(properties, num_key, key, val) {
+			if (UNEXPECTED(Z_TYPE_P(val) == IS_REFERENCE)) {
+				zend_throw_error(NULL, "Cannot assign by reference when cloning with updated properties");
+				break;
+			}
+
 			if (UNEXPECTED(key == NULL)) {
 				key = zend_long_to_str(num_key);
 				new_object->handlers->write_property(new_object, key, val, NULL);