From e14b7f629b036f11d875d21b8cb27b079323ce27 Mon Sep 17 00:00:00 2001
From: Timm Friebe <thekid@thekid.de>
Date: Sat, 27 Sep 2014 19:24:19 +0000
Subject: [PATCH] Fix segmentation fault in debug_backtrace()

---
 ...debug_backtrace_with_include_and_this.phpt | 39 +++++++++++++++++++
 Zend/zend_builtin_functions.c                 |  1 +
 2 files changed, 40 insertions(+)
 create mode 100644 Zend/tests/debug_backtrace_with_include_and_this.phpt

diff --git a/Zend/tests/debug_backtrace_with_include_and_this.phpt b/Zend/tests/debug_backtrace_with_include_and_this.phpt
new file mode 100644
index 0000000000..171ad9f451
--- /dev/null
+++ b/Zend/tests/debug_backtrace_with_include_and_this.phpt
@@ -0,0 +1,39 @@
+--TEST--
+debug_backtrace segmentation fault with include and error handler 
+--FILE--
+<?php
+class CLWrapper {
+  function stream_open($path, $mode, $options, $opened_path) {
+    return false;
+  }
+}
+
+class CL {
+  public function load($class) {
+    if (!include($class)) {
+      throw new Exception('Failed loading '.$class);
+    }
+  }
+}
+
+stream_wrapper_register('class', 'CLWrapper');
+set_error_handler(function($code, $msg, $file, $line) {
+  $bt= debug_backtrace(DEBUG_BACKTRACE_IGNORE_ARGS, 2);
+  echo "ERR#$code: $msg @ ", $bt[1]['function'], "\n";
+});
+
+try {
+  (new CL())->load('class://non.existant.Class');
+} catch (CLException $e) {
+  echo $e."\n";
+}
+--EXPECTF--
+ERR#2: include(class://non.existant.Class): failed to open stream: "CLWrapper::stream_open" call failed @ include
+ERR#2: include(): Failed opening 'class://non.existant.Class' for inclusion (include_path='%s') @ include
+
+Fatal error: Uncaught exception 'Exception' with message 'Failed loading class://non.existant.Class' in %s
+Stack trace:
+#0 %s(%d): CL->load('class://non.exi...')
+#1 {main}
+  thrown in %s on line %d
+
diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
index 0cbe50bc0f..9d8cda84d6 100644
--- a/Zend/zend_builtin_functions.c
+++ b/Zend/zend_builtin_functions.c
@@ -2396,6 +2396,7 @@ ZEND_API void zend_fetch_debug_backtrace(zval *return_value, int skip_last, int
 		/* $this may be passed into regular internal functions */
 		object = call ? call->object : NULL;
 		if (object &&
+		    call->func &&
 		    call->func->type == ZEND_INTERNAL_FUNCTION &&
 		    !call->func->common.scope) {
 			object = NULL;
-- 
2.40.0