From 6ed16753c146ea2a06271ac537761430bad3059a Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Sat, 20 Apr 2013 15:23:49 +0800
Subject: [PATCH] Fixed bug #64677 (execution operator `` stealing surrounding
 arguments)

---
 NEWS                     |  4 ++++
 Zend/tests/bug64677.phpt | 21 +++++++++++++++++++++
 Zend/zend_compile.c      |  1 +
 3 files changed, 26 insertions(+)
 create mode 100644 Zend/tests/bug64677.phpt

diff --git a/NEWS b/NEWS
index 969780e9ce..15aa0bcad7 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 20??, PHP 5.5.0 Beta 4
 
+- Core:
+  . Fixed bug #64677 (execution operator `` stealing surrounding arguments). 
+    (Laruence)
+
 - Zip:
   . Fixed bug #64342 (ZipArchive::addFile() has to check for file existence).
     (Anatol)
diff --git a/Zend/tests/bug64677.phpt b/Zend/tests/bug64677.phpt
new file mode 100644
index 0000000000..44a7c5fc6f
--- /dev/null
+++ b/Zend/tests/bug64677.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #64677 (execution operator `` stealing surrounding arguments)
+--FILE--
+<?PHP
+class cat {
+	public function show_output($prepend, $output = '') {
+	}
+}
+$cat = new cat();
+$cat->show_output('Files: ', trim(`cd .`)); // this gives invalid args to shell_exec
+$cat->show_output('Files: ', `cd .`); // this causes a segmentation fault
+$cat->show_output(`cd .`); // this causes a segmentation fault
+
+function show_outputa($prepend, $output) {
+	echo "Okey";
+}
+show_outputa('Files: ', `cd .`); // this works as expected
+
+?>
+--EXPECT--
+Okey
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 7680790918..3c0d753b66 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -5702,6 +5702,7 @@ void zend_do_shell_exec(znode *result, const znode *cmd TSRMLS_DC) /* {{{ */
 	GET_CACHE_SLOT(opline->op1.constant);
 	opline->extended_value = 1;
 	SET_UNUSED(opline->op2);
+	opline->op2.num = CG(context).nested_calls;
 	GET_NODE(result, opline->result);
 
 	if (CG(context).nested_calls + 1 > CG(active_op_array)->nested_calls) {
-- 
2.40.0