Fixed bug #33802 (throw Exception in error handler causes crash)

diff --git a/NEWS b/NEWS
index 4599f8bef2b5fa742820c0268e4da888616b1cfb..ea75f7e62478a39b2f755aa8af3cf51350210362 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2005, PHP 5.1
+- Fixed bug #33802 (throw Exception in error handler causes crash). (Dmitry)
 - Fixed bug #33710 (ArrayAccess objects doen't initialize $this). (Dmitry)
 - Fixed bug #33578 (strtotime() problem with "Oct17" format). (Derick)
 - Fixed bug #33558 (warning with nested calls to functions returning by

diff --git a/Zend/tests/bug33802.phpt b/Zend/tests/bug33802.phpt
new file mode 100755 (executable)
index 0000000..d2f8cd7
--- /dev/null
+++ b/Zend/tests/bug33802.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #33802 (throw Exception in error handler causes crash)
+--FILE--
+<?php
+set_error_handler('errorHandler', E_USER_ERROR);
+try{
+    test();
+}catch(Exception $e){
+}
+restore_error_handler();
+
+function test(){
+    trigger_error("error", E_USER_ERROR);
+}
+
+function errorHandler($errno, $errstr, $errfile, $errline) {
+    throw new Exception();
+}
+?>
+ok
+--EXPECT--
+ok

diff --git a/Zend/zend.c b/Zend/zend.c
index ba84e39a5fe2e9921b67af7c7534e669986c1a44..eb79640b28895f38510e9cef3bcfe5e5e371485a 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -975,8 +975,7 @@ ZEND_API void zend_error(int type, const char *format, ...)
 
                        z_context->value.ht = EG(active_symbol_table);
                        z_context->type = IS_ARRAY;
-                       ZVAL_ADDREF(z_context); /* we don't want this one to be freed */
-                       z_context->is_ref = 1;
+                       zval_copy_ctor(z_context);
 
                        params = (zval ***) emalloc(sizeof(zval **)*5);
                        params[0] = &z_error_type;
@@ -989,9 +988,6 @@ ZEND_API void zend_error(int type, const char *format, ...)
                        EG(user_error_handler) = NULL;
            
                        if (call_user_function_ex(CG(function_table), NULL, orig_user_error_handler, &retval, 5, params, 1, NULL TSRMLS_CC)==SUCCESS) {
-                               if (Z_TYPE_P(z_context) != IS_ARRAY || z_context->value.ht != EG(active_symbol_table)) {
-                                       zend_error(E_ERROR, "User error handler must not modify error context");
-                               }
                                if (retval) {
                                        if (Z_TYPE_P(retval) == IS_BOOL && Z_LVAL_P(retval) == 0) {
                                                zend_error_cb(type, error_filename, error_lineno, format, args);
@@ -1015,12 +1011,7 @@ ZEND_API void zend_error(int type, const char *format, ...)
                        zval_ptr_dtor(&z_error_type);
                        zval_ptr_dtor(&z_error_filename);
                        zval_ptr_dtor(&z_error_lineno);
-                       if (ZVAL_REFCOUNT(z_context) <= 2) {
-                               FREE_ZVAL(z_context);
-                       } else {
-                               ZVAL_DELREF(z_context);
-                               zval_ptr_dtor(&z_context);
-                       }
+                       zval_ptr_dtor(&z_context);
                        break;
        }