fix regression bug #50394: Reference argument converted to value in __call

diff --git a/Zend/tests/bug50394.phpt b/Zend/tests/bug50394.phpt
new file mode 100644 (file)
index 0000000..e6069d3
--- /dev/null
+++ b/Zend/tests/bug50394.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #50394: Reference argument converted to value in __call
+--FILE--
+<?php
+function inc( &$x ) { $x++; }
+
+class Proxy {
+        function __call( $name, $args ) {
+               echo "$name called!\n";
+                call_user_func_array( 'inc', $args );
+        }
+}
+
+$arg = 1;
+$args = array( &$arg );
+$proxy = new Proxy;
+call_user_func_array( array( $proxy, 'bar' ), $args );
+call_user_func_array( array( $proxy, 'bar' ), array(&$arg) );
+var_dump($arg);
+--EXPECT--     
+bar called!
+bar called!
+int(3)
+

diff --git a/Zend/tests/call_with_refs.phpt b/Zend/tests/call_with_refs.phpt
new file mode 100644 (file)
index 0000000..acad134
--- /dev/null
+++ b/Zend/tests/call_with_refs.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Check call to non-ref function with call-time refs
+--FILE--
+<?php
+function my_errorhandler($errno,$errormsg) {
+  global $my_var;
+  $my_var=0x12345;
+  echo $errormsg."\n";
+  return true;
+}
+$oldhandler = set_error_handler("my_errorhandler");
+$my_var = str_repeat("A",64);
+$data = call_user_func_array("substr_replace",array(&$my_var, new StdClass(),1));
+echo "OK!";
+--EXPECT--     
+Object of class stdClass could not be converted to string
+Object of class stdClass to string conversion
+OK!

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index ead346d1979d3e73464a0adf52c4cc3bb3d89814..a67c407def1d570eb199710e0e52e83751f1db56 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -838,6 +838,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
                zval *param;
 
                if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION 
+                       && (EX(function_state).function->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) == 0 
                        && !ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 1)
                        && PZVAL_IS_REF(*fci->params[i])) {
                        SEPARATE_ZVAL(fci->params[i]);