Patch bug61165.phpt for Reproducible crash Bug #61165

Patch version 2012-02-24 17:02 UTC

• 2012-02-24 17:02 UTC [diff to current]

Developer: laruence@php.net

Index: Zend/zend_API.c
===================================================================
--- Zend/zend_API.c	(revision 323331)
+++ Zend/zend_API.c	(working copy)
@@ -262,8 +262,9 @@
 static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int type TSRMLS_DC) /* {{{ */
 {
 	if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
+		zval *obj = *arg;
 		SEPARATE_ZVAL_IF_NOT_REF(arg);
-		if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, type TSRMLS_CC) == SUCCESS) {
+		if (Z_OBJ_HANDLER_PP(arg, cast_object)(obj, *arg, type TSRMLS_CC) == SUCCESS) {
 			*pl = Z_STRLEN_PP(arg);
 			*p = Z_STRVAL_PP(arg);
 			return SUCCESS;
@@ -271,8 +272,9 @@
 	}
 	/* Standard PHP objects */
 	if (Z_OBJ_HT_PP(arg) == &std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) {
+		zval *obj = *arg;
 		SEPARATE_ZVAL_IF_NOT_REF(arg);
-		if (zend_std_cast_object_tostring(*arg, *arg, type TSRMLS_CC) == SUCCESS) {
+		if (zend_std_cast_object_tostring(obj, *arg, type TSRMLS_CC) == SUCCESS) {
 			*pl = Z_STRLEN_PP(arg);
 			*p = Z_STRVAL_PP(arg);
 			return SUCCESS;