From 543cb52b41132372a32a066b3a9a97b082f4f97f Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Thu, 1 May 2025 00:19:51 +0200
Subject: [PATCH] Fix reference handling of grapheme_extract()

---
 ext/intl/grapheme/grapheme_string.c           | 17 ++++++-----------
 .../tests/grapheme_extract_references.phpt    | 19 +++++++++++++++++++
 2 files changed, 25 insertions(+), 11 deletions(-)
 create mode 100644 ext/intl/tests/grapheme_extract_references.phpt

diff --git a/ext/intl/grapheme/grapheme_string.c b/ext/intl/grapheme/grapheme_string.c
index a9cfd3d2ea6e5..698b75ce30b46 100644
--- a/ext/intl/grapheme/grapheme_string.c
+++ b/ext/intl/grapheme/grapheme_string.c
@@ -711,15 +711,10 @@ PHP_FUNCTION(grapheme_extract)
 	}
 
 	if ( NULL != next ) {
-		if ( !Z_ISREF_P(next) ) {
-			intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,
-				 "grapheme_extract: 'next' was not passed by reference", 0 );
-			RETURN_FALSE;
-		} else {
-			ZVAL_DEREF(next);
-			/* initialize next */
-			zval_ptr_dtor(next);
-			ZVAL_LONG(next, lstart);
+		ZEND_ASSERT(Z_ISREF_P(next));
+		ZEND_TRY_ASSIGN_REF_LONG(next, lstart);
+		if (UNEXPECTED(EG(exception))) {
+			RETURN_THROWS();
 		}
 	}
 
@@ -776,7 +771,7 @@ PHP_FUNCTION(grapheme_extract)
 	if ( -1 != grapheme_ascii_check((unsigned char *)pstr, MIN(size + 1, str_len)) ) {
 		size_t nsize = MIN(size, str_len);
 		if ( NULL != next ) {
-			ZVAL_LONG(next, start+nsize);
+			ZEND_TRY_ASSIGN_REF_LONG(next, start + nsize);
 		}
 		RETURN_STRINGL(pstr, nsize);
 	}
@@ -810,7 +805,7 @@ PHP_FUNCTION(grapheme_extract)
 	ubrk_close(bi);
 
 	if ( NULL != next ) {
-		ZVAL_LONG(next, start+ret_pos);
+		ZEND_TRY_ASSIGN_REF_LONG(next, start + ret_pos);
 	}
 
 	RETURN_STRINGL(((char *)pstr), ret_pos);
diff --git a/ext/intl/tests/grapheme_extract_references.phpt b/ext/intl/tests/grapheme_extract_references.phpt
new file mode 100644
index 0000000000000..33368279a1a6d
--- /dev/null
+++ b/ext/intl/tests/grapheme_extract_references.phpt
@@ -0,0 +1,19 @@
+--TEST--
+grapheme_extract() references handling
+--EXTENSIONS--
+intl
+--FILE--
+<?php
+class Test {
+    public string $prop = "a";
+}
+$test = new Test;
+$next =& $test->prop;
+grapheme_extract("test", 4, next: $next);
+var_dump($test);
+?>
+--EXPECT--
+object(Test)#1 (1) {
+  ["prop"]=>
+  &string(1) "4"
+}