Fixed bug #25922 (Crash in error handler when 5th argument is modified).

diff --git a/Zend/zend.c b/Zend/zend.c
index 013c107f3e6ec88780adc1fcb0e23da75d542557..2e5d37cfc8775c6538341a8740c6b7bbe0181544 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -840,7 +840,6 @@ ZEND_API void zend_error(int type, const char *format, ...)
        zval ***params;
        zval *retval;
        zval *z_error_type, *z_error_message, *z_error_filename, *z_error_lineno, *z_context;
-       zval lz_context;
        char *error_filename;
        uint error_lineno;
        zval *orig_user_error_handler;
@@ -903,6 +902,7 @@ ZEND_API void zend_error(int type, const char *format, ...)
                        ALLOC_INIT_ZVAL(z_error_type);
                        ALLOC_INIT_ZVAL(z_error_filename);
                        ALLOC_INIT_ZVAL(z_error_lineno);
+                       ALLOC_INIT_ZVAL(z_context);
 
                        z_error_message->value.str.len = zend_vspprintf(&z_error_message->value.str.val, 0, format, args);
                        z_error_message->type = IS_STRING;
@@ -919,11 +919,9 @@ ZEND_API void zend_error(int type, const char *format, ...)
                        z_error_lineno->value.lval = error_lineno;
                        z_error_lineno->type = IS_LONG;
 
-                       lz_context.value.ht = EG(active_symbol_table);
-                       lz_context.type = IS_ARRAY;
-                       lz_context.is_ref = 1;
-                       lz_context.refcount = 2; /* we don't want this one to be freed */
-                       z_context = &lz_context;
+                       z_context->value.ht = EG(active_symbol_table);
+                       z_context->type = IS_ARRAY;
+                       ZVAL_ADDREF(z_context); /* we don't want this one to be freed */
 
                        params = (zval ***) emalloc(sizeof(zval **)*5);
                        params[0] = &z_error_type;
@@ -949,7 +947,9 @@ ZEND_API void zend_error(int type, const char *format, ...)
                        zval_ptr_dtor(&z_error_type);
                        zval_ptr_dtor(&z_error_filename);
                        zval_ptr_dtor(&z_error_lineno);
-                       ZVAL_DELREF(z_context);
+                       if (ZVAL_REFCOUNT(z_context) == 2) {
+                               FREE_ZVAL(z_context);
+                       }
                        break;
        }
 

diff --git a/tests/lang/bug25922.phpt b/tests/lang/bug25922.phpt
new file mode 100755 (executable)
index 0000000..0588eef
--- /dev/null
+++ b/tests/lang/bug25922.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #25922 (SEGV in error_handler when context is destroyed)
+--INI--
+error_reporting=2047
+--FILE--
+<?php
+function my_error_handler($error, $errmsg='', $errfile='', $errline=0, $errcontext='')
+{
+       $errcontext = '';
+}
+                                                                                        
+set_error_handler('my_error_handler');
+
+function test()
+{
+       echo "Undefined index here: '{$data['HTTP_HEADER']}'\n";
+}
+test();
+?>
+--EXPECT--
+Undefined index here: ''