- Fix crash bug in call_user_function_ex(). Thanks to Sebastian for the

- very nice and short reproducing script.
<?php
	$array = array('foo', 'bar');

	uasort($array, 'cmp');

	function cmp($a, $b)
	{
		return (strcmp($a[1], $b[1]));
	}
?>

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 0a3892bac8eef5094d206759712c556536a9ce42..8927b37084bde56c3cc41b0377f4b6c01589f8a5 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -545,9 +545,10 @@ int call_user_function_ex(HashTable *function_table, zval **object_pp, zval *fun
        EG(namespace) = calling_namespace;
 
        current_this = EG(this);
-       EG(this) = *object_pp;
 
-       if (EG(this)) {
+       if (object_pp) {
+               EG(this) = *object_pp;
+
                if (!PZVAL_IS_REF(EG(this))) {
                        EG(this)->refcount++; /* For $this pointer */
                } else {
@@ -559,6 +560,8 @@ int call_user_function_ex(HashTable *function_table, zval **object_pp, zval *fun
                        zval_copy_ctor(this_ptr);
                        EG(this) = this_ptr;
                }
+       } else {
+               EG(this) = NULL;
        }