From: Andi Gutmans <andi@php.net>
Date: Mon, 14 Jan 2002 16:55:23 +0000 (+0000)
Subject: - Fix crash bug in call_user_function_ex(). Thanks to Sebastian for the
X-Git-Tag: PRE_ISSET_PATCH~193
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=65f01545a86b7e8eff264e30ffb22372e8ca7784;p=php

- Fix crash bug in call_user_function_ex(). Thanks to Sebastian for the
- very nice and short reproducing script.
<?php
	$array = array('foo', 'bar');

	uasort($array, 'cmp');

	function cmp($a, $b)
	{
		return (strcmp($a[1], $b[1]));
	}
?>
---

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 0a3892bac8..8927b37084 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -545,9 +545,10 @@ int call_user_function_ex(HashTable *function_table, zval **object_pp, zval *fun
 	EG(namespace) = calling_namespace;
 
 	current_this = EG(this);
-	EG(this) = *object_pp;
 
-	if (EG(this)) {
+	if (object_pp) {
+		EG(this) = *object_pp;
+
 		if (!PZVAL_IS_REF(EG(this))) {
 			EG(this)->refcount++; /* For $this pointer */
 		} else {
@@ -559,6 +560,8 @@ int call_user_function_ex(HashTable *function_table, zval **object_pp, zval *fun
 			zval_copy_ctor(this_ptr);
 			EG(this) = this_ptr;
 		}
+	} else {
+		EG(this) = NULL;
 	}