Fix #79979: passing value to by-ref param via CUF(A) crashes

[cmb69]

Passing values to by-reference parameters is an error, if the function
is called directly. If the function is called via call_user_func()
or call_user_func_array(), however, only a warning is triggered.
Therefore we have to make sure to not call ZEND_TRY_ASSIGN_REF_*()
for non-references.

---

This is just an examplary fix for exec; sever other functions would need to be fixed the same way.

An alternative fix would be to make the ZEND_TRY_ASSIGN_REF_*() macros more liberal, e.g.

 Zend/zend_API.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Zend/zend_API.h b/Zend/zend_API.h
index 2a3b582902..99994bcc69 100644
--- a/Zend/zend_API.h
+++ b/Zend/zend_API.h
@@ -799,8 +799,9 @@ ZEND_API int zend_try_assign_typed_ref_zval_ex(zend_reference *ref, zval *zv, ze
 	_ZEND_TRY_ASSIGN_LONG(zv, lval, 0)
 
 #define ZEND_TRY_ASSIGN_REF_LONG(zv, lval) do { \
-	ZEND_ASSERT(Z_ISREF_P(zv)); \
-	_ZEND_TRY_ASSIGN_LONG(zv, lval, 1); \
+	if (Z_ISREF_P(zv)) { \
+		_ZEND_TRY_ASSIGN_LONG(zv, lval, 1); \
+	} \
 } while (0)
 
 #define _ZEND_TRY_ASSIGN_DOUBLE(zv, dval, is_ref) do { \

[cmb69]

@dstogov, what do you think about this?

[nikic]

This needs to be addressed in the implementation of zend_call_function. It needs to create a dummy reference wrapper in this case, similarly to what we do in normal SEND_* opcodes, even if we throw "cannot be passed by reference" warnings.

[cmb69]

Thanks Nikita! I'll have a look at this as soon as possible.