Fixed bug #25922 (In error handler, modifying 5th arg (errcontext) may result in...

diff --git a/Zend/zend.c b/Zend/zend.c
index f95d240170a03cf0988ee4a80ff530dd2ea8d0a4..ab66e16ee92e32620ed2200abc4efd1408ce5c8f 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -980,6 +980,9 @@ ZEND_API void zend_error(int type, const char *format, ...)
                        EG(user_error_handler) = NULL;
            
                        if (call_user_function_ex(CG(function_table), NULL, orig_user_error_handler, &retval, 5, params, 1, NULL TSRMLS_CC)==SUCCESS) {
+                               if (Z_TYPE_P(z_context) != IS_ARRAY || z_context->value.ht != EG(active_symbol_table)) {
+                                       zend_error(E_ERROR, "User error handler must not modify error context");
+                               }
                                if (retval) {
                                        if (Z_TYPE_P(retval) == IS_BOOL && Z_LVAL_P(retval) == 0) {
                                                zend_error_cb(type, error_filename, error_lineno, format, args);

diff --git a/tests/lang/bug25922.phpt b/tests/lang/bug25922.phpt
index 0588eef949af4ad6b3ee40cc1f848672da8b4d95..1191472f29c2d5061f2c528edb52d4e7547aa334 100755 (executable)
--- a/tests/lang/bug25922.phpt
+++ b/tests/lang/bug25922.phpt
@@ -17,5 +17,5 @@ function test()
 }
 test();
 ?>
---EXPECT--
-Undefined index here: ''
+--EXPECTF--
+Fatal error: User error handler must not modify error context in %sbug25922.php on line 11