Commit 762fdd56c9b for php.net

commit 762fdd56c9b7c3a335ddddb79cd326ac6962f676
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Sun Sep 20 12:04:55 2026 +0200

    Fix OSS-Fuzz #538730793: Assertion failure when returning by-ref from closure invoke

    Forgot one place in this file where we have to unwrap the reference, the
    `zend_closure_call_magic` function had this already but the invoke was
    missing.

    Closes GH-23787.

diff --git a/NEWS b/NEWS
index 9e8da51adbb..69e1b9ade9f 100644
--- a/NEWS
+++ b/NEWS
@@ -12,6 +12,8 @@ PHP                                                                        NEWS
   . Fixed bug GH-23752 (Use scoped diagnostic suppression for the global
     register declarations so the caller's -Wvolatile-register-var state is
     restored). (yqtian-se)
+  . Fixed OSS-Fuzz #538730793 (Assertion failure when returning by-ref from
+    closure invoke). (ndossche)

 - CLI
   . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during
diff --git a/Zend/tests/closures/oss_fuzz_538730793.phpt b/Zend/tests/closures/oss_fuzz_538730793.phpt
new file mode 100644
index 00000000000..e5347a03ee9
--- /dev/null
+++ b/Zend/tests/closures/oss_fuzz_538730793.phpt
@@ -0,0 +1,13 @@
+--TEST--
+OSS-Fuzz #538730793 (Assertion failure when returning by-ref from closure invoke)
+--FILE--
+<?php
+
+$x = function&(){};
+$y = $x->__invoke();
+var_dump($y);
+
+?>
+--EXPECTF--
+Notice: Only variable references should be returned by reference in %s on line %d
+NULL
diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
index 788957d1c3a..d4c0b588136 100644
--- a/Zend/zend_closures.c
+++ b/Zend/zend_closures.c
@@ -74,6 +74,7 @@ ZEND_METHOD(Closure, __invoke) /* {{{ */
 	zend_closure_get_closure(Z_OBJ_P(ZEND_THIS), &fcc.calling_scope, &fcc.function_handler, &fcc.object, false);
 	fcc.called_scope = fcc.calling_scope;
 	zend_call_known_fcc(&fcc, return_value, num_args, args, named_args);
+	zend_return_unwrap_ref(execute_data, return_value);

 	/* destruct the function also, then - we have allocated it in get_method */
 	zend_string_release_ex(func->internal_function.function_name, 0);