FIxed bug #80299

The must_wrap was leaking across iterations.

Author: nikic

NEWS

@@ -12,6 +12,10 @@ PHP                                                                        NEWS
 - Opcache:
   . Fixed run-time binding of preloaded dynamically declared function. (Dmitry)
 
+- Reflection:
+  . Fixed bug #80299 (ReflectionFunction->invokeArgs confused in arguments).
+    (Nikita)
+
 - Standard:
   . Don't force rebuild of symbol table, when populating $http_response_header
     variable by the HTTP stream wrapper. (Dmitry)

Zend/zend_execute_API.c

@@ -807,8 +807,8 @@ zend_result zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_
 		zval *arg;
 		uint32_t arg_num = ZEND_CALL_NUM_ARGS(call) + 1;
 		zend_bool have_named_params = 0;
-		zend_bool must_wrap = 0;
 		ZEND_HASH_FOREACH_STR_KEY_VAL(fci->named_params, name, arg) {
+			zend_bool must_wrap = 0;
 			zval *target;
 			if (name) {
 				void *cache_slot[2] = {NULL, NULL};

ext/reflection/tests/bug80299.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #80299: ReflectionFunction->invokeArgs confused in arguments
+--FILE--
+<?php
+
+$bar = new DateTime();
+$args = [1, &$bar];
+
+$function = function (int &$foo, DateTimeInterface &$bar) {};
+
+(new ReflectionFunction($function))->invokeArgs($args);
+
+?>
+--EXPECTF--
+Warning: {closure}(): Argument #1 ($foo) must be passed by reference, value given in %s on line %d