- Check another incarnation of bug #30266

2 files changed, 38 insertions, 1 deletions

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 894f99a426..1175b3303a 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1038,7 +1038,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 	zend_hash_internal_pointer_reset_ex(target_hash, &pos);
 
 	/* Iterate through hash */
-	while (zend_hash_get_current_data_ex(target_hash, (void **)&args[0], &pos) == SUCCESS) {
+	while (!EG(exception) && zend_hash_get_current_data_ex(target_hash, (void **)&args[0], &pos) == SUCCESS) {
 		if (recursive && Z_TYPE_PP(args[0]) == IS_ARRAY) {
 			HashTable *thash;
 			
diff --git a/ext/standard/tests/array/bug30266.phpt b/ext/standard/tests/array/bug30266.phpt
new file mode 100755
index 0000000000..8f7c3d2135
--- /dev/null
+++ b/ext/standard/tests/array/bug30266.phpt
@@ -0,0 +1,37 @@
+--TEST--
+Bug #30266 (Invalid opcode 137/1/8) and array_walk
+--FILE--
+<?php
+class testc
+{
+	public $b = "c";
+
+	function crash($val)
+	{
+		$this->b = $val;
+		throw new Exception("Error");
+	}
+}
+
+$fruits = array ("d"=>"lemon", "a"=>"orange", "b"=>"banana", "c"=>"apple");
+
+$myobj = new testc();
+
+function test($item2, $key, $userd)
+{
+	$userd->crash($item2);
+}
+
+try
+{
+	array_walk($fruits, 'test', $myobj);
+}
+catch(Exception $e)
+{
+	echo "Caught: " . $e->getMessage() . "\n";
+}
+?>
+===DONE===
+--EXPECT--
+Caught: Error
+===DONE===