From: Dmitry Stogov <dmitry@zend.com>
Date: Wed, 5 Mar 2014 21:04:28 +0000 (+0400)
Subject: Fixed passing reference by value in call_user_func()
X-Git-Tag: POST_PHPNG_MERGE~412^2~409^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f3b4b1688314caa6f3dc32ef6aa796642c408d1f;p=php

Fixed passing reference by value in call_user_func()
---

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 02030ff413..fb214dba10 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -868,7 +868,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 		           /* don't separate references for __call */
 		           (EX(function_state).function->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) == 0 ) {
 			param = &tmp;
-			ZVAL_DUP(param, &fci->params[i]);
+			ZVAL_DUP(param, Z_REFVAL(fci->params[i]));
 		} else {
 			param = &tmp;
 			ZVAL_COPY(param, &fci->params[i]);