Fix a possible crash bug in call_user_function_ex(), if the function is

in fact not a user function

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 8fe3ce1fb6f238ff96015ab132c96a1f02088d1e..30159a64769491d1bf4e86ae993622da93c46398 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -446,7 +446,7 @@ int call_user_function_ex(HashTable *function_table, zval **object_pp, zval *fun
                EG(opline_ptr) = original_opline_ptr;
        } else {
                ALLOC_INIT_ZVAL(*retval_ptr_ptr);
-               ((zend_internal_function *) function_state.function)->handler(param_count, *retval_ptr_ptr, *object_pp, 1 ELS_CC);
+               ((zend_internal_function *) function_state.function)->handler(param_count, *retval_ptr_ptr, (object_pp?*object_pp:NULL), 1 ELS_CC);
                INIT_PZVAL(*retval_ptr_ptr);
        }
        zend_ptr_stack_clear_multiple(ELS_C);