Fixed bug #76366 (references in sub-array for filtering breaks the fi…

…lter)

NEWS

@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.1.21
 
+- Filter:
+  . Fixed bug #76366 (References in sub-array for filtering breaks the filter).
+    (ZiHang Gao)
+
 - PDO_Firebird:
   . Fixed bug #76488 (Memory leak when fetching a BLOB field). (Simonov Denis)
 

ext/filter/filter.c

@@ -621,6 +621,9 @@ static void php_filter_call(zval *filtered, zend_long filter, zval *filter_args,
 		}
 
 		if ((option = zend_hash_str_find(HASH_OF(filter_args), "options", sizeof("options") - 1)) != NULL) {
+			/* avoid reference type */
+			ZVAL_DEREF(option);
+
 			if (filter != FILTER_CALLBACK) {
 				if (Z_TYPE_P(option) == IS_ARRAY) {
 					options = option;

ext/filter/tests/bug76366.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Bug #76366 (references in sub-array for filtering breaks the filter)
+--SKIPIF--
+<?php
+if (!extension_loaded('filter')) die('skip filter extension not available');
+?>
+--FILE--
+<?php
+
+#array to filter
+$data = ['foo' => 6];
+
+#filter args
+$args = [
+    'foo'=> [
+        'filter' => FILTER_VALIDATE_INT,
+        'flags' => FILTER_FORCE_ARRAY
+    ]
+];
+
+$args['foo']['options'] = [];
+
+#create reference
+$options = &$args['foo']['options'];
+
+#set options
+$options['min_range'] = 1;
+$options['max_range'] = 5;
+
+#show the filter result
+var_dump(filter_var_array($data, $args));
+?>
+--EXPECT--
+array(1) {
+  ["foo"]=>
+  array(1) {
+    [0]=>
+    bool(false)
+  }
+}