From c65fd57a2409d9ef293ae536fcf692194bf86b0d Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 29 Jul 2003 17:54:15 +0000
Subject: [PATCH] Test case & news for bug #22836.

---
 NEWS                     |  5 +++--
 tests/lang/bug22836.phpt | 22 ++++++++++++++++++++++
 2 files changed, 25 insertions(+), 2 deletions(-)
 create mode 100644 tests/lang/bug22836.phpt

diff --git a/NEWS b/NEWS
index c441030a72..d6ec46cc4f 100644
--- a/NEWS
+++ b/NEWS
@@ -57,10 +57,11 @@ PHP 4                                                                      NEWS
 - Fixed bug #23792 (imagerotate() problems with limited platte, the function
   will always return true color image from now on). (Pierre-Alain Joye)
 - Fixed bug #23664 (FastCGI socket listenting). (Shane)
-- Fixed bug #22690 (ob_start() did not work with create_function() callbacks).
-  (Marcus)
 - Fixed bug #23685 (fake values returned when OID value is an empty string).
   (Jani)
+- Fixed bug #22836 (memory corruption with references to NULL). (Ilia)
+- Fixed bug #22690 (ob_start() did not work with create_function() callbacks).
+  (Marcus)
 - Fixed bug #21855 (Threading issue on HP-UX). (Roshan Naik, Andi, Moriyoshi)
 - Fixed bug #21074 (Apache2: "ErrorDocument xxx /error.php" broken). (Jani)
 - Fixed bug #19613 (putenv("VAR=") does not empty VAR on win32). (Zeev)
diff --git a/tests/lang/bug22836.phpt b/tests/lang/bug22836.phpt
new file mode 100644
index 0000000000..2fe95cddff
--- /dev/null
+++ b/tests/lang/bug22836.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #22836 (returning references to NULL)
+--FILE--
+<?php
+function &f()
+{
+	$x = "foo";
+        var_dump($x);
+        print "'$x'\n";
+        return ($a);
+}
+for ($i = 0; $i < 8; $i++) {
+	$h =& f();
+}
+?>
+--EXPECTF--
+string(3) "foo"
+'foo'
+
+Notice: Undefined variable:  a in %s on line %d
+
+Fatal error: Cannot return NULL by reference in %s on line %d
-- 
2.50.1