From db4f369170c27e0fa9c8e75680efd05f82ad8ca9 Mon Sep 17 00:00:00 2001
From: Andreas Braun <andreas.braun@mongodb.com>
Date: Tue, 24 Sep 2024 16:26:00 +0200
Subject: [PATCH] PHPC-2456: Correctly dereference arrays in type maps

---
 src/contrib/php_array_api.h | 10 +++++++---
 tests/bson/bug2456-001.phpt | 22 ++++++++++++++++++++++
 2 files changed, 29 insertions(+), 3 deletions(-)
 create mode 100644 tests/bson/bug2456-001.phpt

diff --git a/src/contrib/php_array_api.h b/src/contrib/php_array_api.h
index 76358dbb9..17dc74810 100644
--- a/src/contrib/php_array_api.h
+++ b/src/contrib/php_array_api.h
@@ -420,7 +420,9 @@ char *php_array_zval_to_string(zval *z, int *plen, zend_bool *pfree) {
  * zval *php_array_fetchz_array(zval *zarr, zval *key)
  */
 static inline zval *php_array_zval_to_array(zval *zarr) {
-	return (zarr && (Z_TYPE_P(zarr) == IS_ARRAY)) ? zarr : NULL;
+	if (!zarr) { return NULL; }
+	ZVAL_DEREF(zarr);
+	return Z_TYPE_P(zarr) == IS_ARRAY ? zarr : NULL;
 }
 PHP_ARRAY_FETCH_TYPE_MAP(zval*, array)
 #define php_array_fetchc_array(zarr, litstr) \
@@ -493,8 +495,10 @@ void *php_array_zval_to_resource(zval *z, int le) {
  */
 static inline
 zval *php_array_zval_to_object(zval *z, zend_class_entry *ce) {
-	return (z && (Z_TYPE_P(z) == IS_OBJECT) &&
-	        ((!ce) || instanceof_function(Z_OBJCE_P(z), ce))) ? z : NULL;
+	if (!z) { return NULL; }
+	ZVAL_DEREF(z);
+	if (Z_TYPE_P(z) != IS_OBJECT) { return NULL; }
+	return (!ce) || instanceof_function(Z_OBJCE_P(z), ce) ? z : NULL;
 }
 #define php_array_fetch_object(zarr, key, ce) \
 	php_array_zval_to_object(php_array_fetch(zarr, key), ce)
diff --git a/tests/bson/bug2456-001.phpt b/tests/bson/bug2456-001.phpt
new file mode 100644
index 000000000..53726a28c
--- /dev/null
+++ b/tests/bson/bug2456-001.phpt
@@ -0,0 +1,22 @@
+--TEST--
+PHPC-2456: References passed in a typeMap
+--FILE--
+<?php
+require_once __DIR__ . "/../utils/basic.inc";
+
+$fieldPaths = [];
+
+$typeMap = ['fieldPaths' => &$fieldPaths];
+
+var_dump(MongoDB\BSON\Document::fromPHP([])->toPHP($typeMap));
+var_dump(MongoDB\BSON\PackedArray::fromPHP([])->toPHP($typeMap));
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+object(stdClass)#%d (0) {
+}
+array(0) {
+}
+===DONE===