Fixed bug #55578 (Segfault on implode/concat)

diff --git a/Zend/tests/bug55578.phpt b/Zend/tests/bug55578.phpt
new file mode 100644 (file)
index 0000000..4a8604a
--- /dev/null
+++ b/Zend/tests/bug55578.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #55578 (Segfault on implode/concat)
+--FILE--
+<?php  
+$options = array();
+
+class Foo {
+    public function __toString() {
+        return 'Foo';
+    }
+}   
+
+function test($options, $queryPart) {
+       return ''. (0 ? 1 : $queryPart);
+}
+
+var_dump(test($options, new Foo()));
+?>
+--EXPECT--
+string(3) "Foo"

diff --git a/Zend/zend.c b/Zend/zend.c
index d222e262894fc85a53fb26fe33c8edd7837639d1..833539d9d2a5fbc2a4a2cfc02bfbf42542345aec 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -257,8 +257,17 @@ ZEND_API void zend_make_printable_zval(zval *expr, zval *expr_copy, int *use_cop
                        {
                                TSRMLS_FETCH();
 
-                               if (Z_OBJ_HANDLER_P(expr, cast_object) && Z_OBJ_HANDLER_P(expr, cast_object)(expr, expr_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
-                                       break;
+                               if (Z_OBJ_HANDLER_P(expr, cast_object)) {
+                                       zval *val;
+
+                                       ALLOC_ZVAL(val);
+                                       INIT_PZVAL_COPY(val, expr);
+                                       zval_copy_ctor(val);
+                                       if (Z_OBJ_HANDLER_P(expr, cast_object)(val, expr_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
+                                               zval_ptr_dtor(&val);
+                                               break;
+                                       }
+                                       zval_ptr_dtor(&val);
                                }
                                /* Standard PHP objects */
                                if (Z_OBJ_HT_P(expr) == &std_object_handlers || !Z_OBJ_HANDLER_P(expr, cast_object)) {