The following C code mimics the reference leak behavior of a by-reference foreach loop in PHP. By intentionally leaving current pointing to the last element after the first loop, we can reproduce the same silent array corruption that occurs in PHP.
#include <stdio.h>
int main()
{
int arr[] = {1, 2, 3, 4};
int *current;
//First Loop doubles the array
for (size_t i = 0; i < sizeof(arr) / sizeof(arr[0]); i++)
{
//arr[i] === *(arr + i)
arr[i] *= 2;
current = arr + i;
printf("Current modified:%d\n", *current);
}
/*
After the loop completes, the arr is now {2,4,6,8}.
As for current, it is going to have the memory location of the last element (memory location of 8).
*/
for (size_t i = 0; i < sizeof(arr) / sizeof(arr[0]); i++)
{
/*
In each iteration, the memory location of 8 is going to be dereferenced and set to arr[i].
As a result, the last value will be equal to the value before it
*/
*current = arr[i];
printf("Current:%d\n", *current);
}
return 0;
}
Just as PHP's $value remains a reference to the last element after a by-reference foreach, current here remains a pointer to arr[3]. Every iteration of the second loop writes into arr[3], ultimately copying the second-to-last value onto the last element.