- Fixed a crash when sending a non-variable expression to a runtime-bound function

  that expected a reference.

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 0404b6537dd5148f7597003723a0463f86636ded..47e0795a89961d149832632642843e5f3cb5ae96 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -1756,6 +1756,10 @@ send_by_ref:
                                        zval *varptr;
                                        varptr_ptr = get_zval_ptr_ptr(&opline->op1, Ts, BP_VAR_W);
 
+                                       if (!varptr_ptr) {
+                                               zend_error(E_ERROR, "Only variables can be passed by reference");
+                                       }
+
                                        varptr = *varptr_ptr;
 
                                        if (!PZVAL_IS_REF(varptr)) {