Bug #25547 (error_handler and array index with function call) was fixed

tests/lang/bug25547.phpt

1 files changed, 18 insertions, 0 deletions

diff --git a/Zend/zend.c b/Zend/zend.c
index 5dbfb950da..cfaa465590 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -863,6 +863,8 @@ ZEND_API void zend_error(int type, const char *format, ...)
 	char *error_filename;
 	uint error_lineno;
 	zval *orig_user_error_handler;
+	zval *orig_garbage[2];
+	int  orig_garbage_ptr;
 	TSRMLS_FETCH();
 
 	/* Obtain relevant filename and lineno */
@@ -953,6 +955,13 @@ ZEND_API void zend_error(int type, const char *format, ...)
 
 			orig_user_error_handler = EG(user_error_handler);
 			EG(user_error_handler) = NULL;
+	    
+			orig_garbage_ptr = EG(garbage_ptr);
+			EG(garbage_ptr) = 0;
+			if (orig_garbage_ptr > 0) {
+				memcpy(&orig_garbage, &EG(garbage), sizeof(zval*)*orig_garbage_ptr);
+			}
+
 			if (call_user_function_ex(CG(function_table), NULL, orig_user_error_handler, &retval, 5, params, 1, NULL TSRMLS_CC)==SUCCESS) {
 				if (retval) {
 					zval_ptr_dtor(&retval);
@@ -961,6 +970,15 @@ ZEND_API void zend_error(int type, const char *format, ...)
 				/* The user error handler failed, use built-in error handler */
 				zend_error_cb(type, error_filename, error_lineno, format, args);
 			}
+
+			if (orig_garbage_ptr > 0) {
+				while (EG(garbage_ptr)) {
+					zval_ptr_dtor(&EG(garbage)[--EG(garbage_ptr)]);
+				}				
+				EG(garbage_ptr) = orig_garbage_ptr;
+				memcpy(&EG(garbage), &orig_garbage, sizeof(zval*)*orig_garbage_ptr);
+			}
+
 			EG(user_error_handler) = orig_user_error_handler;
 
 			efree(params);