Bug in fsockopen() implementation?

Hello, during my experiments with the PHP 4 source I do not know if I stumbled across a bug in the fsockopen() implementation. Right at the top of the function, the following code is located: switch(arg_count) { case 5: convert_to_double_ex(args[4]); conv = (unsigned long) ((*args[4])->value.dval * 1000000.0); timeout.tv_sec = conv / 1000000; timeout.tv_usec = conv % 1000000; /* fall-through */ case 4: if(!ParameterPassedByReference(ht,4)) { php_error(E_WARNING,"error string argument to fsockopen not passed by reference"); } pval_copy_constructor(*args[3]); (*args[3])->value.str.val = empty_string; (*args[3])->value.str.len = 0; (*args[3])->type = IS_STRING; /* fall-through */ case 3: if(!ParameterPassedByReference(ht,3)) { php_error(E_WARNING,"error argument to fsockopen not passed by reference"); } (*args[2])->type = IS_LONG; (*args[2])->value.lval = 0; break; } The last case statement modifies the args[2] pval container, retrieved with zend_get_parameters_array_ex(), without taking any precautions. Andi corrected me in my last mail that the _ex() functions only allow read-only access, this code however changes type and value of args[2] without calling any convert_to_*_ex(), SEPARATE_ZVAL() or pval_copy_constructor(). Not providing a diff here in case I am wrong again (and for the extremely simple nature of this eventual change) Till