- MFZE1

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index a37fcc9066f0595272fe2d1e4d95e61f659b7240..8056cfe55987534b4e891c27db4284843d519838 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -1014,7 +1014,11 @@ ZEND_API int add_char_to_string(zval *result, zval *op1, zval *op2)
 ZEND_API int add_string_to_string(zval *result, zval *op1, zval *op2)
 {
        int length = op1->value.str.len + op2->value.str.len;
-       result->value.str.val = (char *) erealloc(op1->value.str.val, length+1);
+       if (op1->value.str.val == empty_string) {
+               result->value.str.val = (char *) emalloc(length+1);
+       } else {
+               result->value.str.val = (char *) erealloc(op1->value.str.val, length+1);
+       }
     memcpy(result->value.str.val+op1->value.str.len, op2->value.str.val, op2->value.str.len);
     result->value.str.val[length] = 0;
        result->value.str.len = length;