Fixed segfault due to missing REFCOUNTED check

diff --git a/Zend/zend.h b/Zend/zend.h
index 44266c29ce83c6085a0327008b92a63454498410..b62a022e42d4e3b3ecd908184df5ce12a21bef39 100644 (file)
--- a/Zend/zend.h
+++ b/Zend/zend.h
@@ -733,11 +733,11 @@ END_EXTERN_C()
        Z_SET_REFCOUNT_PP(ppzv_dest, refcount);         \
 }
 
-#define SEPARATE_ARG_IF_REF(varptr) \
-       if (Z_ISREF_P(varptr)) { \
-               ZVAL_DUP(varptr, Z_REFVAL_P(varptr)); \
-       } else { \
-               Z_ADDREF_P(varptr); \
+#define SEPARATE_ARG_IF_REF(varptr)                            \
+       if (Z_ISREF_P(varptr)) {                                                \
+               ZVAL_DUP(varptr, Z_REFVAL_P(varptr));           \
+       } else if (IS_REFCOUNTED(Z_TYPE_P(varptr))) {   \
+               Z_ADDREF_P(varptr);                                             \
        }
 
 #define READY_TO_DESTROY(zv) \

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index e2737a270caa1a0230d88ea0f0cf49dae744ec89..f1ba871712143ec3676e953583bc25b9216beeb1 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -176,7 +176,9 @@ ZEND_API int zend_copy_parameters_array(int param_count, zval *argument_array TS
 
        while (param_count-->0) {
                zval *param = p-(arg_count--);
-               Z_ADDREF_P(param);
+               if (Z_REFCOUNTED_P(param)) {
+                       Z_ADDREF_P(param);
+               }
                add_next_index_zval(argument_array, param);
        }