`mail()` throws `TypeError` after iterating over `$additional_headers` array by reference

[ras52]

Description

The following code:

<?php
$headers = ['From' => 'test@example.com'];
foreach ($headers as $n => &$v) ;
mail('test2@example.com', 'Test', 'Test', $headers);

... resulted in this output in PHP 8.x:

PHP Fatal error:  Uncaught TypeError: Header "From" must be of type array|string, string given in /home/richard/test.php:4
Stack trace:
#0 /home/richard/test.php(4): mail()
#1 {main}
  thrown in /home/richard/test.php on line 4

I can't see how this can be anything other than a bug.

(The message is worded slightly different in 7.x, but clearly the same issue. It also proceeds to send the message but with no additional headers at all. I appreciated PHP 7.x is unsupported – I include this for information only. In PHP 8.x, the message is not sent at all.)

Comment out the iteration and it works (i.e. produces no output). It also works if you replace the iteration with one by value, i.e.

foreach ($headers as $n => $v) ;

Adding print_r($headers) before and after the iteration show, as expected, that the array has not changed.

Attempted workarounds like calling reset($headers) (in case it's some weirdness with internal array pointers), doing $v = (string)$v in the loop, or copying the array, either directly or indirectly with $headers = array_merge([], $headers); do not help. Workarounds that entirely avoid iteration by reference, e.g. by building up a second array, do work.

PHP Version

PHP 8.1.13, 8.0.26, 7.4.33 and 7.3.31

Operating System

Debian 11

[nielsdos]

This does indeed feel like a bug. The reason it breaks is that the foreach loop converts the value to a reference, and it looks like this isn't dealt with in mail().