From 65cb18dd5fbfb0f8174d29e7a812f47a16c3425a Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@php.net>
Date: Wed, 14 Sep 2011 13:18:19 +0000
Subject: [PATCH] Fixed bug #55578 (Segfault on implode/concat)

---
 Zend/tests/bug55578.phpt | 20 ++++++++++++++++++++
 Zend/zend.c              | 13 +++++++++++--
 2 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 Zend/tests/bug55578.phpt

diff --git a/Zend/tests/bug55578.phpt b/Zend/tests/bug55578.phpt
new file mode 100644
index 0000000000..4a8604a23b
--- /dev/null
+++ b/Zend/tests/bug55578.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #55578 (Segfault on implode/concat)
+--FILE--
+<?php  
+$options = array();
+
+class Foo {
+    public function __toString() {
+        return 'Foo';
+    }
+}   
+
+function test($options, $queryPart) {
+	return ''. (0 ? 1 : $queryPart);
+}
+
+var_dump(test($options, new Foo()));
+?>
+--EXPECT--
+string(3) "Foo"
diff --git a/Zend/zend.c b/Zend/zend.c
index d222e26289..833539d9d2 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -257,8 +257,17 @@ ZEND_API void zend_make_printable_zval(zval *expr, zval *expr_copy, int *use_cop
 			{
 				TSRMLS_FETCH();
 
-				if (Z_OBJ_HANDLER_P(expr, cast_object) && Z_OBJ_HANDLER_P(expr, cast_object)(expr, expr_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
-					break;
+				if (Z_OBJ_HANDLER_P(expr, cast_object)) {
+					zval *val;
+
+					ALLOC_ZVAL(val);
+					INIT_PZVAL_COPY(val, expr);
+					zval_copy_ctor(val);
+					if (Z_OBJ_HANDLER_P(expr, cast_object)(val, expr_copy, IS_STRING TSRMLS_CC) == SUCCESS) {
+						zval_ptr_dtor(&val);
+						break;
+					}
+					zval_ptr_dtor(&val);
 				}
 				/* Standard PHP objects */
 				if (Z_OBJ_HT_P(expr) == &std_object_handlers || !Z_OBJ_HANDLER_P(expr, cast_object)) {
-- 
2.50.1