Merge branch 'PHP-8.4' into PHP-8.5

* PHP-8.4:
  Fix hooked object properties overflow

NEWS

@@ -21,6 +21,7 @@ PHP                                                                        NEWS
   . Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may
     uaf). (ilutov)
   . Fixed bug GH-20905 (Lazy proxy bailing __clone assertion). (ilutov)
+  . Fixed bug GH-20479 (Hooked object properties overflow). (ndossche)
 
 - Date:
   . Update timelib to 2022.16. (Derick)

Zend/tests/property_hooks/gh20479.phpt

@@ -0,0 +1,40 @@
+--TEST--
+GH-20479: Hooked object properties overflow
+--CREDITS--
+Viet Hoang Luu (@vi3tL0u1s)
+--FILE--
+<?php
+
+#[AllowDynamicProperties]
+class Trigger {
+    public $a = 'x';
+    public $b = 'x';
+    public $c = 'x';
+    public $d = 'x';
+    public $e = 'x';
+    public $f = 'x';
+    public string $trigger {
+      get {
+        return 'trigger';
+      }
+    }
+}
+
+$obj = new Trigger();
+// Add 2 dynamic props
+$obj->g = $obj->h = 'x';
+var_export($obj);
+
+?>
+--EXPECT--
+\Trigger::__set_state(array(
+   'a' => 'x',
+   'b' => 'x',
+   'c' => 'x',
+   'd' => 'x',
+   'e' => 'x',
+   'f' => 'x',
+   'trigger' => 'trigger',
+   'h' => 'x',
+   'g' => 'x',
+))

Zend/zend_property_hooks.c

@@ -121,7 +121,7 @@ skip_property:
 			if (Z_TYPE_P(prop_value) == IS_INDIRECT) {
 				continue;
 			}
-			zval *tmp = _zend_hash_append(properties, prop_name, prop_value);
+			zval *tmp = zend_hash_add_new(properties, prop_name, prop_value);
 			Z_TRY_ADDREF_P(tmp);
 		} ZEND_HASH_FOREACH_END();
 	}