Merge branch 'PHP-7.4' into master

* PHP-7.4:
  Fix #72941: Modifying bucket->data by-ref has no effect any longer

Author: cmb69

ext/standard/tests/filters/bug72941.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Bug #72941 (Modifying bucket->data by-ref has no effect any longer)
+--FILE--
+<?php
+class rotate_filter_nw extends php_user_filter
+{
+    function filter($in, $out, &$consumed, $closing)
+    {
+        while ($bucket = stream_bucket_make_writeable($in)) {
+            $this->rotate($bucket->data);
+            $consumed += $bucket->datalen;
+            stream_bucket_prepend($out, $bucket);
+        }
+
+        return PSFS_PASS_ON;
+    }
+
+    function rotate(&$data)
+    {
+        $n = strlen($data);
+        for ($i = 0; $i < $n - 1; ++$i) {
+            $data[$i] = $data[$i + 1];
+        }
+    }
+}
+
+stream_filter_register("rotator_notWorking", rotate_filter_nw::class);
+$stream = fopen('php://memory', 'w+');
+fwrite($stream, 'hello, world');
+rewind($stream);
+stream_filter_append($stream, "rotator_notWorking");
+var_dump(stream_get_contents($stream));
+?>
+--EXPECT--
+string(12) "ello, worldd"

ext/standard/user_filters.c

@@ -425,7 +425,7 @@ static void php_stream_bucket_attach(int append, INTERNAL_FUNCTION_PARAMETERS)
 		Z_PARAM_OBJECT(zobject)
 	ZEND_PARSE_PARAMETERS_END();
 
-	if (NULL == (pzbucket = zend_hash_str_find(Z_OBJPROP_P(zobject), "bucket", sizeof("bucket")-1))) {
+	if (NULL == (pzbucket = zend_hash_str_find_deref(Z_OBJPROP_P(zobject), "bucket", sizeof("bucket")-1))) {
 		zend_argument_value_error(2, "must be an object that has a \"bucket\" property");
 		RETURN_THROWS();
 	}
@@ -439,7 +439,7 @@ static void php_stream_bucket_attach(int append, INTERNAL_FUNCTION_PARAMETERS)
 		RETURN_THROWS();
 	}
 
-	if (NULL != (pzdata = zend_hash_str_find(Z_OBJPROP_P(zobject), "data", sizeof("data")-1)) && Z_TYPE_P(pzdata) == IS_STRING) {
+	if (NULL != (pzdata = zend_hash_str_find_deref(Z_OBJPROP_P(zobject), "data", sizeof("data")-1)) && Z_TYPE_P(pzdata) == IS_STRING) {
 		if (!bucket->own_buf) {
 			bucket = php_stream_bucket_make_writeable(bucket);
 		}