- Fixed bug #52573 (SplFileObject::fscanf Segmentation fault)

diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index cc049a1e27b021f4c18feeb4579d1fe90c26d657..fe3262ba429908fdc920a8a272c69bf18a1d2cd1 100755 (executable)
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -1865,7 +1865,11 @@ static int spl_filesystem_file_call(spl_filesystem_object *intern, zend_function
 
        result = zend_call_function(&fci, &fcic TSRMLS_CC);
        
-       ZVAL_ZVAL(return_value, retval, 1, 1);
+       if (result == FAILURE) {
+               RETVAL_FALSE;
+       } else {
+               ZVAL_ZVAL(return_value, retval, 1, 1);
+       }
 
        efree(params);
        return result;

diff --git a/ext/spl/tests/bug52573.phpt b/ext/spl/tests/bug52573.phpt
new file mode 100644 (file)
index 0000000..17f2984
--- /dev/null
+++ b/ext/spl/tests/bug52573.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #52573 (SplFileObject::fscanf Segmentation fault)
+--FILE--
+<?php
+
+$result = null;
+$f = new SplFileObject(__FILE__, 'r');
+$f->fscanf('<?php // %s', $result);
+
+?>
+--EXPECTF--
+Warning: Parameter 3 to fscanf() expected to be a reference, value given in %s on line 5