Fixed possible crash on $x = $obj->$non_string

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index 9d3f09bca6b105142fd8ef958dadeeeda7f2b32a..493bd113d665c05671512a7816f39e10558cdb6c 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -330,9 +330,9 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC)
                }
        }
        if (tmp_member) {
-               rv->refcount++;
+               (*retval)->refcount++;
                zval_ptr_dtor(&tmp_member);
-               rv->refcount--;
+               (*retval)->refcount--;
        }
        return *retval;
 }