Fixed bug #72051 (The reference in CallbackFilterIterator doesn't work as expected)

3 files changed, 37 insertions, 5 deletions

diff --git a/NEWS b/NEWS
index 97b192c5f3..440ce4e2f4 100644
--- a/NEWS
+++ b/NEWS
@@ -24,6 +24,10 @@ PHP                                                                        NEWS
   . Fixed bug #71972 (Cyclic references causing session_start(): Failed to
     decode session object). (Laruence)
 
+- SPL:
+  . Fixed bug #72051 (The reference in CallbackFilterIterator doesn't work as
+    expected). (Laruence)
+
 - SQLite3:
   . Fixed bug #68849 (bindValue is not using the right data type). (Anatol)
 
diff --git a/ext/spl/spl_iterators.c b/ext/spl/spl_iterators.c
index 8ff3427011..6a0049733f 100644
--- a/ext/spl/spl_iterators.c
+++ b/ext/spl/spl_iterators.c
@@ -1998,7 +1998,6 @@ SPL_METHOD(CallbackFilterIterator, accept)
 	zend_fcall_info        *fci = &intern->u.cbfilter->fci;
 	zend_fcall_info_cache  *fcc = &intern->u.cbfilter->fcc;
 	zval                    params[3];
-	zval                    result;
 
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -2012,19 +2011,22 @@ SPL_METHOD(CallbackFilterIterator, accept)
 	ZVAL_COPY_VALUE(&params[1], &intern->current.key);
 	ZVAL_COPY_VALUE(&params[2], &intern->inner.zobject);
 
-	fci->retval = &result;
+	fci->retval = return_value;
 	fci->param_count = 3;
 	fci->params = params;
 	fci->no_separation = 0;
 
-	if (zend_call_function(fci, fcc) != SUCCESS || Z_TYPE(result) == IS_UNDEF) {
+	if (zend_call_function(fci, fcc) != SUCCESS || Z_ISUNDEF_P(return_value)) {
 		RETURN_FALSE;
 	}
+
 	if (EG(exception)) {
-		return;
+		RETURN_NULL();
 	}
 
-	RETURN_ZVAL(&result, 1, 1);
+	/* zend_call_function may change args to IS_REF */
+	ZVAL_COPY_VALUE(&intern->current.data, &params[0]);
+	ZVAL_COPY_VALUE(&intern->current.key, &params[1]);
 }
 /* }}} */
 
diff --git a/ext/spl/tests/bug72051.phpt b/ext/spl/tests/bug72051.phpt
new file mode 100644
index 0000000000..1dfc056d7e
--- /dev/null
+++ b/ext/spl/tests/bug72051.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #72051 (The reference in CallbackFilterIterator doesn't work as expected)
+--FILE--
+<?php
+
+$data = [
+	[1,2]
+];
+
+$callbackTest = new CallbackFilterIterator(new ArrayIterator($data), function (&$current) {
+	$current['message'] = 'Test message';
+	return true;
+});
+
+$callbackTest->rewind();
+$data = $callbackTest->current();
+$callbackTest->next();
+print_r($data);
+?>
+--EXPECT--
+Array
+(
+    [0] => 1
+    [1] => 2
+    [message] => Test message
+)