From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Thu, 13 Nov 2003 20:53:55 +0000 (+0000)
Subject: Bugfix #26156 (REPLACE_ZVAL_VALUE works on uninit stack-based zvals)
X-Git-Tag: php-5.0.0b3RC1~693
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=138b1c7be323d38a6446b83e440f0d326dbf3925;p=php

Bugfix #26156 (REPLACE_ZVAL_VALUE works on uninit stack-based zvals)
---

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 453f1f0f5c..6b581138e3 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -494,10 +494,7 @@ ZEND_API void _convert_to_string(zval *op ZEND_FILE_LINE_DC)
 		case IS_OBJECT: {
 			TSRMLS_FETCH();
 			if (op->value.obj.handlers->cast_object) {
-				zval tmp;
-				if (op->value.obj.handlers->cast_object(op, &tmp, IS_STRING, 1 TSRMLS_CC) == SUCCESS && tmp.type == IS_STRING) {
-					zval_dtor(op);
-					*op = tmp;
+				if (op->value.obj.handlers->cast_object(op, op, IS_STRING, 1 TSRMLS_CC) == SUCCESS) {
 					break;
 				}
 				zend_error(E_NOTICE, "Object of class %s could not be converted to string", Z_OBJCE_P(op)->name);