From f046cdf3fa1558232c0658d3587220b5deab68a0 Mon Sep 17 00:00:00 2001
From: Antony Dovgal <tony2001@php.net>
Date: Tue, 27 Dec 2005 22:32:01 +0000
Subject: [PATCH] fix #35821 (array_map() segfaults when exception is throwed
 from the callback)

---
 NEWS                                   |  2 ++
 ext/standard/array.c                   |  2 +-
 ext/standard/tests/array/bug35821.phpt | 33 ++++++++++++++++++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/array/bug35821.phpt

diff --git a/NEWS b/NEWS
index 7833ae83497..12a24d3af25 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,8 @@ PHP                                                                        NEWS
 - Fixed segfault/leak in imagecolormatch(). (Pierre)
 - Fixed small leak in mysqli_stmt_fetch() when bound variable was empty string.
   (Andrey)
+- Fixed bug #35821 (array_map() segfaults when exception is throwed from 
+  the callback). (Tony)
 - Fixed bug #35781 (stream_filter_append() can cause segfault). (Tony)
 - Fixed bug #35759 (mysqli_stmt_bind_result() makes huge allocation when
   column empty). (Andrey)
diff --git a/ext/standard/array.c b/ext/standard/array.c
index a083db59a9d..bb6338dd73e 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4347,7 +4347,7 @@ PHP_FUNCTION(array_map)
 			fci.params = &params[1];
 			fci.no_separation = 0;
 
-			if (!zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS && result) {
+			if (!zend_call_function(&fci, &fci_cache TSRMLS_CC) == SUCCESS || !result) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "An error occurred while invoking the map callback");
 				efree(array_len);
 				efree(args);
diff --git a/ext/standard/tests/array/bug35821.phpt b/ext/standard/tests/array/bug35821.phpt
new file mode 100644
index 00000000000..095323ebcd0
--- /dev/null
+++ b/ext/standard/tests/array/bug35821.phpt
@@ -0,0 +1,33 @@
+--TEST--
+Bug #35821 (array_map() segfaults when exception is throwed from the callback)
+--FILE--
+<?php
+
+class Element
+{
+	public function ThrowException ()
+	{
+		throw new Exception();
+	}
+
+	public static function CallBack(Element $elem)
+	{
+		$elem->ThrowException();
+	}
+}
+
+$arr = array(new Element(), new Element(), new Element());
+array_map(array('Element', 'CallBack'), $arr);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Warning: array_map(): An error occurred while invoking the map callback in %s on line %d
+
+Fatal error: Uncaught exception 'Exception' in %s:%d
+Stack trace:
+#0 %s(%d): Element->ThrowException()
+#1 [internal function]: Element::CallBack(Object(Element))
+#2 %s(%d): array_map(Array, Array)
+#3 {main}
+  thrown in %s on line %d