- Fixed bug #52573 (SplFileObject::fscanf Segmentation fault)

diff --git a/NEWS b/NEWS
index cc819be5a6f2bc89a3dc8028759e5f6da77749c4..40354d8d76b3a1396733aebde8e81b7e8afec39f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2010, PHP 5.3.4
+- Fixed bug #52573 (SplFileObject::fscanf Segmentation fault). (Felipe)
 - Fixed bug #52546 (pdo_dblib segmentation fault when iterating MONEY values).
   (Felipe)
 - Fixed bug #52534 (var_export array with negative key). (Felipe)

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index 7c4cb9517904bef3bed2feb506ba25a2f6495600..1c21a53ec3cbf78eb0567e559ff0614ebf3b01b3 100755 (executable)
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -1862,7 +1862,11 @@ static int spl_filesystem_file_call(spl_filesystem_object *intern, zend_function
 
        result = zend_call_function(&fci, &fcic TSRMLS_CC);
        
-       ZVAL_ZVAL(return_value, retval, 1, 1);
+       if (result == FAILURE) {
+               RETVAL_FALSE;
+       } else {
+               ZVAL_ZVAL(return_value, retval, 1, 1);
+       }
 
        efree(params);
        return result;

diff --git a/ext/spl/tests/bug52573.phpt b/ext/spl/tests/bug52573.phpt
new file mode 100644 (file)
index 0000000..17f2984
--- /dev/null
+++ b/ext/spl/tests/bug52573.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #52573 (SplFileObject::fscanf Segmentation fault)
+--FILE--
+<?php
+
+$result = null;
+$f = new SplFileObject(__FILE__, 'r');
+$f->fscanf('<?php // %s', $result);
+
+?>
+--EXPECTF--
+Warning: Parameter 3 to fscanf() expected to be a reference, value given in %s on line 5