Fixed bug #72922 COM called from PHP does not return out parameters

Author: weltling

NEWS

@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Fixed bug #72854 (PHP Crashes on duplicate destructor call). (Nikita)
   . Fixed bug #72857 (stream_socket_recvfrom read access violation). (Anatol)
 
+- COM:
+  . Fixed bug #72922 (COM called from PHP does not return out parameters).
+    (Anatol)
+
 - FTP:
   . Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with
     require_ssl_reuse). (Benedict Singer)

ext/com_dotnet/com_com.c

@@ -553,22 +553,23 @@ int php_com_do_invoke_byref(php_com_dotnet_object *obj, zend_internal_function *
 			for (i = 0, j = 0; i < nargs; i++) {
 				/* if this was byref, update the zval */
 				if (f->arg_info[nargs - i - 1].pass_by_reference) {
-					SEPARATE_ZVAL_IF_NOT_REF(&args[nargs - i - 1]);
+					zval *arg = &args[nargs - i - 1];
+
+					ZVAL_DEREF(arg);
+					SEPARATE_ZVAL_NOREF(arg);
 
 					/* if the variant is pointing at the byref_vals, we need to map
 					 * the pointee value as a zval; otherwise, the value is pointing
 					 * into an existing PHP variant record */
 					if (V_VT(&vargs[i]) & VT_BYREF) {
 						if (vargs[i].byref == &V_UINT(&byref_vals[j])) {
 							/* copy that value */
-							php_com_zval_from_variant(&args[nargs - i - 1], &byref_vals[j],
-								obj->code_page);
+							php_com_zval_from_variant(arg, &byref_vals[j], obj->code_page);
 						}
 					} else {
 						/* not sure if this can ever happen; the variant we marked as BYREF
 						 * is no longer BYREF - copy its value */
-						php_com_zval_from_variant(&args[nargs - i - 1], &vargs[i],
-							obj->code_page);
+						php_com_zval_from_variant(arg, &vargs[i], obj->code_page);
 					}
 					VariantClear(&byref_vals[j]);
 					j++;

ext/com_dotnet/com_handlers.c

@@ -305,7 +305,8 @@ static union _zend_function *com_method_get(zend_object **object_ptr, zend_strin
 							for (i = 0; i < bindptr.lpfuncdesc->cParams; i++) {
 								f.arg_info[i].allow_null = 1;
 								if (bindptr.lpfuncdesc->lprgelemdescParam[i].paramdesc.wParamFlags & PARAMFLAG_FOUT) {
-									f.arg_info[i].pass_by_reference = 1;
+									f.arg_info[i].pass_by_reference = ZEND_SEND_BY_REF;
+									ZEND_SET_ARG_FLAG(fptr, i + 1, ZEND_SEND_BY_REF);
 								}
 							}