Bugfix #26156 (REPLACE_ZVAL_VALUE works on uninit stack-based zvals)

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 453f1f0f5c326c39628429f7fc4a65598e1d0ab1..6b581138e3a5f52320f1e82cbf933e98c1d6e1f4 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -494,10 +494,7 @@ ZEND_API void _convert_to_string(zval *op ZEND_FILE_LINE_DC)
                case IS_OBJECT: {
                        TSRMLS_FETCH();
                        if (op->value.obj.handlers->cast_object) {
-                               zval tmp;
-                               if (op->value.obj.handlers->cast_object(op, &tmp, IS_STRING, 1 TSRMLS_CC) == SUCCESS && tmp.type == IS_STRING) {
-                                       zval_dtor(op);
-                                       *op = tmp;
+                               if (op->value.obj.handlers->cast_object(op, op, IS_STRING, 1 TSRMLS_CC) == SUCCESS) {
                                        break;
                                }
                                zend_error(E_NOTICE, "Object of class %s could not be converted to string", Z_OBJCE_P(op)->name);