Fix #81048: phpinfo(INFO_VARIABLES) "Array to string conversion"

Now that we properly dereference references of the superglobals. we
also need to dereference contained references to avoid to string
conversion.

Closes GH-7014.

Author: cmb69

NEWS

@@ -2,7 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.4.21
 
-
+- Standard:
+  . Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
+    (cmb)
 
 03 Jun 2021, PHP 7.4.20
 

ext/standard/info.c

@@ -202,6 +202,7 @@ static ZEND_COLD void php_print_gpcse_array(char *name, uint32_t name_length)
 			} else {
 				php_info_print(" => ");
 			}
+			ZVAL_DEREF(tmp);
 			if (Z_TYPE_P(tmp) == IS_ARRAY) {
 				if (!sapi_module.phpinfo_as_text) {
 					zend_string *str = zend_print_zval_r_to_str(tmp, 0);

ext/standard/tests/bug81048.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion")
+--FILE--
+<?php
+
+$_ENV = [];
+$_SERVER = ['foo' => ['bar' => ['baz' => 'qux']]];
+
+array_walk_recursive($_SERVER, function($value, $key) {
+    // NOP
+});
+
+phpinfo(INFO_VARIABLES);
+?>
+--EXPECT--
+phpinfo()
+
+PHP Variables
+
+Variable => Value
+$_SERVER['foo'] => Array
+(
+    [bar] => Array
+        (
+            [baz] => qux
+        )
+
+)