Fixed bug #22836 (returning reference to uninitialized variable)

diff --git a/NEWS b/NEWS
index 93db8d45db3efbc0669dfa4a147aa2bbd7f17237..9cf006929b7c1b6f2983b1955f85b579af5843ca 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -128,6 +128,7 @@ PHP                                                                        NEWS
   mem vars und others). (Dmitry)
 - Fixed bug #28839 (SIGSEGV in interactive mode (php -a)).
   (kameshj at fastmail dot fm)
+- Fixed bug #22836 (returning reference to uninitialized variable). (Dmitry)
 
 31 Mar 2005, PHP 5.0.4
 - Added SNMPv2 support. (harrie)

diff --git a/Zend/tests/bug22836.phpt b/Zend/tests/bug22836.phpt
index ceaf6414b639635070084e83ef77c5ad6b7893f6..3cbc95493ed292e1e39e0c8a149dfe97a8f4e3a6 100644 (file)
--- a/Zend/tests/bug22836.phpt
+++ b/Zend/tests/bug22836.phpt
@@ -64,11 +64,3 @@ string(3) "foo"
 Notice: Undefined variable: a in %s on line %d
 
 Strict Standards: Only variable references should be returned by reference in %s on line %d
-string(3) "foo"
-'foo'
-
-Notice: Undefined variable: a in %s on line %d
-
-Strict Standards: Only variable references should be returned by reference in %s on line %d
-
-

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index e6e14150f8274c148615d81a5ee32c801685786a..149e504fa82131b44375793867906b67b56751d1 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -2927,7 +2927,8 @@ return_by_value:
                        zend_error(E_STRICT, "Implicit cloning object of class '%s' because of 'zend.ze1_compatibility_mode'", Z_OBJCE_P(retval_ptr)->name);
                        (*EG(return_value_ptr_ptr))->value.obj = Z_OBJ_HT_P(retval_ptr)->clone_obj(retval_ptr TSRMLS_CC);
                } else if (!EG(free_op1)) { /* Not a temp var */
-                       if (PZVAL_IS_REF(retval_ptr) && retval_ptr->refcount > 0) {
+                       if (EG(active_op_array)->return_reference == ZEND_RETURN_REF ||
+                           (PZVAL_IS_REF(retval_ptr) && retval_ptr->refcount > 0)) {
                                ALLOC_ZVAL(*(EG(return_value_ptr_ptr)));
                                **EG(return_value_ptr_ptr) = *retval_ptr;
                                (*EG(return_value_ptr_ptr))->is_ref = 0;