From 442d09d45814af6b50477a38b4a64c4a38c9114f Mon Sep 17 00:00:00 2001
From: Ilija Tovilo <ilija.tovilo@me.com>
Date: Mon, 7 Apr 2025 17:33:47 +0200
Subject: [PATCH] Fix prop info fetching from prop slot with added hooks

Fixes GH-18268
---
 Zend/tests/property_hooks/gh18268.phpt | 23 +++++++++++++++++++++++
 Zend/zend_objects_API.c                |  2 +-
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/property_hooks/gh18268.phpt

diff --git a/Zend/tests/property_hooks/gh18268.phpt b/Zend/tests/property_hooks/gh18268.phpt
new file mode 100644
index 0000000000000..9836bb6d96270
--- /dev/null
+++ b/Zend/tests/property_hooks/gh18268.phpt
@@ -0,0 +1,23 @@
+--TEST--
+GH-18268: array_walk() on object with added property hooks
+--FILE--
+<?php
+
+class A {
+    public $prop = 42;
+}
+
+class B extends A {
+    public $prop = 42 {
+        set {}
+    }
+}
+
+$b = new B;
+array_walk($b, function (&$item) {
+    var_dump($item);
+});
+
+?>
+--EXPECT--
+int(42)
diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index 1ba250bec6439..9c9c720486add 100644
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -203,7 +203,7 @@ ZEND_API void ZEND_FASTCALL zend_objects_store_del(zend_object *object) /* {{{ *
 
 ZEND_API ZEND_COLD zend_property_info *zend_get_property_info_for_slot_slow(zend_object *obj, zval *slot)
 {
-	uintptr_t offset = (uintptr_t)slot - (uintptr_t)obj->properties_table;
+	uintptr_t offset = (uintptr_t)slot - (uintptr_t)obj;
 	zend_property_info *prop_info;
 	ZEND_HASH_MAP_FOREACH_PTR(&obj->ce->properties_info, prop_info) {
 		if (prop_info->offset == offset) {