diff --git a/Zend/tests/closures/oss_fuzz_538730793.phpt b/Zend/tests/closures/oss_fuzz_538730793.phpt new file mode 100644 index 000000000000..e5347a03ee90 --- /dev/null +++ b/Zend/tests/closures/oss_fuzz_538730793.phpt @@ -0,0 +1,13 @@ +--TEST-- +OSS-Fuzz #538730793 (Assertion failure when returning by-ref from closure invoke) +--FILE-- +__invoke(); +var_dump($y); + +?> +--EXPECTF-- +Notice: Only variable references should be returned by reference in %s on line %d +NULL diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c index 4aa467315907..44f7db5020f2 100644 --- a/Zend/zend_closures.c +++ b/Zend/zend_closures.c @@ -74,6 +74,7 @@ ZEND_METHOD(Closure, __invoke) /* {{{ */ zend_closure_get_closure(Z_OBJ_P(ZEND_THIS), &fcc.calling_scope, &fcc.function_handler, &fcc.object, false); fcc.called_scope = fcc.calling_scope; zend_call_known_fcc(&fcc, return_value, num_args, args, named_args); + zend_return_unwrap_ref(execute_data, return_value); /* destruct the function also, then - we have allocated it in get_method */ zend_string_release_ex(func->internal_function.function_name, 0);