--- /dev/null
+--TEST--
+Bug #41970 (call_user_func_*() leaks on failure)
+--FILE--
+<?php
+
+$a = array(4,3,2);
+
+var_dump(call_user_func_array("sort", array($a)));
+var_dump(call_user_func_array("strlen", array($a)));
+var_dump(call_user_func("sort", $a));
+var_dump(call_user_func("strlen", $a));
+
+echo "Done\n";
+?>
+--EXPECTF--
+NULL
+
+Notice: Array to string conversion in %s on line %d
+int(5)
+NULL
+
+Notice: Array to string conversion in %s on line %d
+int(5)
+Done
--- /dev/null
+--TEST--
+call_user_func() and return value
+--FILE--
+<?php
+
+$t1 = 'test1';
+
+function test1($arg1, $arg2)
+{
+ global $t1;
+ echo "$arg1 $arg2\n";
+ return $t1;
+}
+
+$t2 = 'test2';
+
+function & test2($arg1, $arg2)
+{
+ global $t2;
+ echo "$arg1 $arg2\n";
+ return $t2;
+}
+
+function test($func)
+{
+ debug_zval_dump($func('Direct', 'Call'));
+ debug_zval_dump(call_user_func_array($func, array('User', 'Func')));
+}
+
+test('test1');
+test('test2');
+
+?>
+===DONE===
+--EXPECTF--
+Direct Call
+string(5) "test1" refcount(1)
+User Func
+string(5) "test1" refcount(1)
+Direct Call
+string(5) "test2" refcount(2)
+User Func
+string(5) "test2" refcount(1)
+===DONE===