Bug #25547 (error_handler and array index with function call) was fixed

tests/lang/bug25547.phpt

diff --git a/Zend/zend.c b/Zend/zend.c
index 5dbfb950da77961f3e036f3e4c6990b2ce14be3c..cfaa46559017e2599b1eb9d4f54e7a6da19a0b80 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -863,6 +863,8 @@ ZEND_API void zend_error(int type, const char *format, ...)
        char *error_filename;
        uint error_lineno;
        zval *orig_user_error_handler;
+       zval *orig_garbage[2];
+       int  orig_garbage_ptr;
        TSRMLS_FETCH();
 
        /* Obtain relevant filename and lineno */
@@ -953,6 +955,13 @@ ZEND_API void zend_error(int type, const char *format, ...)
 
                        orig_user_error_handler = EG(user_error_handler);
                        EG(user_error_handler) = NULL;
+           
+                       orig_garbage_ptr = EG(garbage_ptr);
+                       EG(garbage_ptr) = 0;
+                       if (orig_garbage_ptr > 0) {
+                               memcpy(&orig_garbage, &EG(garbage), sizeof(zval*)*orig_garbage_ptr);
+                       }
+
                        if (call_user_function_ex(CG(function_table), NULL, orig_user_error_handler, &retval, 5, params, 1, NULL TSRMLS_CC)==SUCCESS) {
                                if (retval) {
                                        zval_ptr_dtor(&retval);
@@ -961,6 +970,15 @@ ZEND_API void zend_error(int type, const char *format, ...)
                                /* The user error handler failed, use built-in error handler */
                                zend_error_cb(type, error_filename, error_lineno, format, args);
                        }
+
+                       if (orig_garbage_ptr > 0) {
+                               while (EG(garbage_ptr)) {
+                                       zval_ptr_dtor(&EG(garbage)[--EG(garbage_ptr)]);
+                               }                               
+                               EG(garbage_ptr) = orig_garbage_ptr;
+                               memcpy(&EG(garbage), &orig_garbage, sizeof(zval*)*orig_garbage_ptr);
+                       }
+
                        EG(user_error_handler) = orig_user_error_handler;
 
                        efree(params);