- Fix for crash bug when using invalid arguments in the foreach() loop.

- Reported by Yasuo Ohgaki

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index 23929bf28674f8977d7610ddc08e1f5c8a5bfdd9..3cca9456698646a821270a996db83ef3bcfb1a14 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -2141,9 +2141,13 @@ send_by_ref:
                                        
                                        if (opline->extended_value) {
                                                array_ptr_ptr = get_zval_ptr_ptr(&opline->op1, Ts, BP_VAR_R);
-                                               SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
-                                               array_ptr = *array_ptr_ptr;
-                                               array_ptr->refcount++;
+                                               if (array_ptr_ptr == NULL) {
+                                                       MAKE_STD_ZVAL(array_ptr);
+                                               } else {
+                                                       SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+                                                       array_ptr = *array_ptr_ptr;
+                                                       array_ptr->refcount++;
+                                               }
                                        } else {
                                                array_ptr = get_zval_ptr(&opline->op1, Ts, &EG(free_op1), BP_VAR_R);
                                                if (EG(free_op1)) { /* IS_TMP_VAR */