Fix bug #68163

Zend/tests/bug68163.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #68163: Using reference as object property name
+--FILE--
+<?php
+
+$obj = (object) ['foo' => 'bar'];
+$foo = 'foo';
+$ref =& $foo;
+var_dump($obj->$foo);
+
+?>
+--EXPECT--
+string(3) "bar"

Zend/zend_object_handlers.c

@@ -475,8 +475,7 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 
 	ZVAL_UNDEF(&tmp_member);
 	if (UNEXPECTED(Z_TYPE_P(member) != IS_STRING)) {
-		ZVAL_DUP(&tmp_member, member);
-		convert_to_string(&tmp_member);
+		ZVAL_STR(&tmp_member, zval_get_string(member));
 		member = &tmp_member;
 		cache_slot = NULL;
 	}
@@ -567,8 +566,7 @@ ZEND_API void zend_std_write_property(zval *object, zval *member, zval *value, v
 
 	ZVAL_UNDEF(&tmp_member);
  	if (UNEXPECTED(Z_TYPE_P(member) != IS_STRING)) {
-		ZVAL_DUP(&tmp_member, member);
-		convert_to_string(&tmp_member);
+		ZVAL_STR(&tmp_member, zval_get_string(member));
 		member = &tmp_member;
 		cache_slot = NULL;
 	}
@@ -786,8 +784,7 @@ static zval *zend_std_get_property_ptr_ptr(zval *object, zval *member, int type,
 
 	ZVAL_UNDEF(&tmp_member);
  	if (UNEXPECTED(Z_TYPE_P(member) != IS_STRING)) {
-		ZVAL_DUP(&tmp_member, member);
-		convert_to_string(&tmp_member);
+		ZVAL_STR(&tmp_member, zval_get_string(member));
 		member = &tmp_member;
 		cache_slot = NULL;
 	}
@@ -855,8 +852,7 @@ static void zend_std_unset_property(zval *object, zval *member, void **cache_slo
 
 	ZVAL_UNDEF(&tmp_member);
  	if (UNEXPECTED(Z_TYPE_P(member) != IS_STRING)) {
-		ZVAL_DUP(&tmp_member, member);
-		convert_to_string(&tmp_member);
+		ZVAL_STR(&tmp_member, zval_get_string(member));
 		member = &tmp_member;
 		cache_slot = NULL;
 	}
@@ -1453,8 +1449,7 @@ static int zend_std_has_property(zval *object, zval *member, int has_set_exists,
 
 	ZVAL_UNDEF(&tmp_member);
 	if (UNEXPECTED(Z_TYPE_P(member) != IS_STRING)) {
-		ZVAL_DUP(&tmp_member, member);
-		convert_to_string(&tmp_member);
+		ZVAL_STR(&tmp_member, zval_get_string(member));
 		member = &tmp_member;
 		cache_slot = NULL;
 	}