Fixed passing reference by value in call_user_func()

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 02030ff413bf4a3f6e2949b3e2f5d0386e7cff31..fb214dba100c842e19b9a46721c5b3f66a2416ac 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -868,7 +868,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
                           /* don't separate references for __call */
                           (EX(function_state).function->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) == 0 ) {
                        param = &tmp;
-                       ZVAL_DUP(param, &fci->params[i]);
+                       ZVAL_DUP(param, Z_REFVAL(fci->params[i]));
                } else {
                        param = &tmp;
                        ZVAL_COPY(param, &fci->params[i]);