From 658272c9eed0250f211ec755d11bce92207b6f67 Mon Sep 17 00:00:00 2001
From: Felipe Pena <felipe@php.net>
Date: Tue, 10 Aug 2010 22:37:24 +0000
Subject: [PATCH] - Fixed bug #52573 (SplFileObject::fscanf Segmentation fault)

---
 NEWS                        |  1 +
 ext/spl/spl_directory.c     |  6 +++++-
 ext/spl/tests/bug52573.phpt | 12 ++++++++++++
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 ext/spl/tests/bug52573.phpt

diff --git a/NEWS b/NEWS
index cc819be5a6..40354d8d76 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2010, PHP 5.3.4
+- Fixed bug #52573 (SplFileObject::fscanf Segmentation fault). (Felipe)
 - Fixed bug #52546 (pdo_dblib segmentation fault when iterating MONEY values).
   (Felipe)
 - Fixed bug #52534 (var_export array with negative key). (Felipe)
diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
index 7c4cb95179..1c21a53ec3 100755
--- a/ext/spl/spl_directory.c
+++ b/ext/spl/spl_directory.c
@@ -1862,7 +1862,11 @@ static int spl_filesystem_file_call(spl_filesystem_object *intern, zend_function
 
 	result = zend_call_function(&fci, &fcic TSRMLS_CC);
 	
-	ZVAL_ZVAL(return_value, retval, 1, 1);
+	if (result == FAILURE) {
+		RETVAL_FALSE;
+	} else {
+		ZVAL_ZVAL(return_value, retval, 1, 1);
+	}
 
 	efree(params);
 	return result;
diff --git a/ext/spl/tests/bug52573.phpt b/ext/spl/tests/bug52573.phpt
new file mode 100644
index 0000000000..17f2984dfb
--- /dev/null
+++ b/ext/spl/tests/bug52573.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #52573 (SplFileObject::fscanf Segmentation fault)
+--FILE--
+<?php
+
+$result = null;
+$f = new SplFileObject(__FILE__, 'r');
+$f->fscanf('<?php // %s', $result);
+
+?>
+--EXPECTF--
+Warning: Parameter 3 to fscanf() expected to be a reference, value given in %s on line 5
-- 
2.40.0