--- /dev/modules/original/services/services/user_service/user_service.inc	2010-10-26 19:54:22.000000000 -0400
+++ /dev/modules/modified/services/services/user_service/user_service.inc	2011-03-14 10:56:25.000000000 -0400
@@ -87,18 +87,21 @@
 
   if ($user->uid) {
     // user is already logged in
     return services_error(t('Already logged in as !user.', array('!user' => $user->name)), 406);
   }
 
-  $user = user_authenticate(array('name' => $username, 'pass' => $password));
+  // Attempt to authenticate the user. Since this function returns NULL on an invalid login, only assign it
+  // to the global $user variable on successful login (below). Without this, Drupal may throw errors.
+  $account = user_authenticate(array('name' => $username, 'pass' => $password));
 
-  if ($user->uid) {
+  if ($account->uid) {
     // Regenerate the session ID to prevent against session fixation attacks.
     sess_regenerate();
     $array = array();
+    $user = $account;
     user_module_invoke('login', $array, $user);
 
     $return = new stdClass();
     $return->sessid = session_id();
     $return->user = $user;