Fixed object to string conversion

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 276f47efaec7a6ad878477d55d022526915f0390..11b16e14727824ad148091945916d14f136def2f 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -1534,14 +1534,12 @@ ZEND_API int zend_std_cast_object_tostring(zval *readobj, zval *writeobj, int ty
 
        switch (type) {
                case IS_STRING:
-               ZVAL_UNDEF(&retval);
+                       ZVAL_UNDEF(&retval);
                        ce = Z_OBJCE_P(readobj);
                        if (ce->__tostring &&
                                (zend_call_method_with_0_params(readobj, ce, &ce->__tostring, "__tostring", &retval) || EG(exception))) {
                                if (UNEXPECTED(EG(exception) != NULL)) {
-                                       if (Z_TYPE(retval) != IS_UNDEF) {
-                                               zval_ptr_dtor(&retval);
-                                       }
+                                       zval_ptr_dtor(&retval);
                                        EG(exception) = NULL;
                                        zend_error_noreturn(E_ERROR, "Method %s::__toString() must not throw an exception", ce->name->val);
                                        return FAILURE;

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 7a66f9f38a9e00f4af56f87336bf60d5511d46fa..8504ca5aaf0b3d1ef1911d01b01d224435052c4f 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -343,6 +343,7 @@ ZEND_API void convert_scalar_to_number(zval *op TSRMLS_DC) /* {{{ */
 #define convert_object_to_type(op, ctype, conv_func)                                                                           \
        if (Z_OBJ_HT_P(op)->cast_object) {                                                                                                              \
                zval dst;                                                                                                                                                       \
+               ZVAL_UNDEF(&dst);                                                                                                                                       \
                if (Z_OBJ_HT_P(op)->cast_object(op, &dst, ctype TSRMLS_CC) == FAILURE) {                        \
                        zend_error(E_RECOVERABLE_ERROR,                                                                                                 \
                                "Object of class %s could not be converted to %s", Z_OBJCE_P(op)->name->val,\
@@ -1634,6 +1635,7 @@ ZEND_API int compare_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {
                                                zend_free_obj_get_result(op_free TSRMLS_CC);
                                                return ret;
                                        } else if (Z_TYPE_P(op2) != IS_OBJECT && Z_OBJ_HT_P(op1)->cast_object) {
+                                               ZVAL_UNDEF(&tmp_free);
                                                if (Z_OBJ_HT_P(op1)->cast_object(op1, &tmp_free, Z_TYPE_P(op2) TSRMLS_CC) == FAILURE) {
                                                        ZVAL_LONG(result, 1);
                                                        zend_free_obj_get_result(&tmp_free TSRMLS_CC);
@@ -1651,6 +1653,7 @@ ZEND_API int compare_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {
                                                zend_free_obj_get_result(op_free TSRMLS_CC);
                                                return ret;
                                        } else if (Z_TYPE_P(op1) != IS_OBJECT && Z_OBJ_HT_P(op2)->cast_object) {
+                                               ZVAL_UNDEF(&tmp_free);
                                                if (Z_OBJ_HT_P(op2)->cast_object(op2, &tmp_free, Z_TYPE_P(op1) TSRMLS_CC) == FAILURE) {
                                                        ZVAL_LONG(result, -1);
                                                        zend_free_obj_get_result(&tmp_free TSRMLS_CC);