Test case & news for bug #22836.

diff --git a/NEWS b/NEWS
index c441030a72f7219c3a430537491f83db5c35a126..d6ec46cc4f1a97c2a8ae7dcad928682b20920b93 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -57,10 +57,11 @@ PHP 4                                                                      NEWS
 - Fixed bug #23792 (imagerotate() problems with limited platte, the function
   will always return true color image from now on). (Pierre-Alain Joye)
 - Fixed bug #23664 (FastCGI socket listenting). (Shane)
-- Fixed bug #22690 (ob_start() did not work with create_function() callbacks).
-  (Marcus)
 - Fixed bug #23685 (fake values returned when OID value is an empty string).
   (Jani)
+- Fixed bug #22836 (memory corruption with references to NULL). (Ilia)
+- Fixed bug #22690 (ob_start() did not work with create_function() callbacks).
+  (Marcus)
 - Fixed bug #21855 (Threading issue on HP-UX). (Roshan Naik, Andi, Moriyoshi)
 - Fixed bug #21074 (Apache2: "ErrorDocument xxx /error.php" broken). (Jani)
 - Fixed bug #19613 (putenv("VAR=") does not empty VAR on win32). (Zeev)

diff --git a/tests/lang/bug22836.phpt b/tests/lang/bug22836.phpt
new file mode 100644 (file)
index 0000000..2fe95cd
--- /dev/null
+++ b/tests/lang/bug22836.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #22836 (returning references to NULL)
+--FILE--
+<?php
+function &f()
+{
+       $x = "foo";
+        var_dump($x);
+        print "'$x'\n";
+        return ($a);
+}
+for ($i = 0; $i < 8; $i++) {
+       $h =& f();
+}
+?>
+--EXPECTF--
+string(3) "foo"
+'foo'
+
+Notice: Undefined variable:  a in %s on line %d
+
+Fatal error: Cannot return NULL by reference in %s on line %d