- Improved fix for bug #52573

Author: felipensp

Zend/zend_compile.c

@@ -2922,7 +2922,8 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 		return 0;
 	}
 
-	if (proto->common.pass_rest_by_reference
+	if (fe->common.type != ZEND_USER_FUNCTION
+		&& proto->common.pass_rest_by_reference
 		&& !fe->common.pass_rest_by_reference) {
 		return 0;
 	}

ext/spl/spl_directory.c

@@ -2586,7 +2586,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fgetss, 0, 0, 0)
 	ZEND_ARG_INFO(0, allowable_tags)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 0, 0, 1) 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_file_object_fscanf, 1, 0, 1) 
 	ZEND_ARG_INFO(0, format)
 ZEND_END_ARG_INFO()
 

ext/spl/tests/bug52573.phpt

@@ -1,12 +1,18 @@
 --TEST--
 Bug #52573 (SplFileObject::fscanf Segmentation fault)
 --FILE--
-<?php
+<?php // test
 
 $result = null;
 $f = new SplFileObject(__FILE__, 'r');
-$f->fscanf('<?php // %s', $result);
-
+var_dump($f->fscanf('<?php // %s', $result));
+var_dump($result);
+var_dump($f->fscanf('<?php // %s'));
 ?>
 --EXPECTF--
-Warning: Parameter 3 to fscanf() expected to be a reference, value given in %s on line 5
+int(1)
+string(4) "test"
+array(1) {
+  [0]=>
+  NULL
+}