- Fix for crash bug when using invalid arguments in the foreach() loop.

- Reported by Yasuo Ohgaki

Author: Andi Gutmans

Zend/zend_execute.c

@@ -2141,9 +2141,13 @@ binary_assign_op_addr: {
 
 					if (opline->extended_value) {
 						array_ptr_ptr = get_zval_ptr_ptr(&opline->op1, Ts, BP_VAR_R);
-						SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
-						array_ptr = *array_ptr_ptr;
-						array_ptr->refcount++;
+						if (array_ptr_ptr == NULL) {
+							MAKE_STD_ZVAL(array_ptr);
+						} else {
+							SEPARATE_ZVAL_IF_NOT_REF(array_ptr_ptr);
+							array_ptr = *array_ptr_ptr;
+							array_ptr->refcount++;
+						}
 					} else {
 						array_ptr = get_zval_ptr(&opline->op1, Ts, &EG(free_op1), BP_VAR_R);
 						if (EG(free_op1)) { /* IS_TMP_VAR */