Returning by ref + finally allow circumventing return type checks

The following code:

<?php

function &test(): int {
    $x = 0;
    try {
        return $x;
    } finally {
        $x = 'test';
    }
}

$x = &test();
var_dump($x);

Resulted in this output:

string(4) "test"

But I expected this output instead:

Fatal error: Uncaught TypeError: test(): Return value must be of type int, string returned

PHP 7.0.2+

No response

Naive guess that this might be from 778e5f3, which moved the finally handling to after the return type check

Fix circumvented type check with return by ref + finally

Navigation Menu