Bug #71756 (Call-by-reference widens scope to uninvolved functions when used in switch)

NEWS

@@ -6,6 +6,8 @@ PHP                                                                        NEWS
   . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
 
 - Core:
+  . Fixed bug #71756 (Call-by-reference widens scope to uninvolved functions
+    when used in switch). (Laruence)
   . Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod,
     zend_hex_strtod). (Laruence)
   . Fixed bug #71695 (Global variables are reserved before execution).

Zend/tests/bug71756.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #71756 (Call-by-reference widens scope to uninvolved functions when used in switch)
+--FILE--
+<?php
+function a ($option) {
+	b($option['bla']);
+	c($option);
+	var_dump($option);
+}
+function b (&$string) {
+	$string = 'changed';
+}
+function c ($option) {
+	switch ($option['bla']) {
+	case 'changed':
+		$copy = $option;
+		$copy['bla'] = 'copy';
+		break;
+	}
+}
+a(array('bla' => 'false'));
+?>
+--EXPECTF--
+array(1) {
+  ["bla"]=>
+  string(7) "changed"
+}

Zend/zend_execute.c

@@ -1562,6 +1562,9 @@ num_index:
 					break;
 			}
 		}
+		if (type == BP_VAR_R) {
+			ZVAL_DEREF(retval);
+		}
 	} else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
 		offset_key = Z_STR_P(dim);
 		if (dim_type != IS_CONST) {
@@ -1593,6 +1596,9 @@ str_index:
 					}
 				}
 			}
+			if (type == BP_VAR_R) {
+				ZVAL_DEREF(retval);
+			}
 		} else {
 			switch (type) {
 				case BP_VAR_R: