[php-src] master: Zend: is_callable() wrongly accepts objects with no get_closure handler.

Author: David Carlier (devnexen) Date: 2026-08-08T18:50:19+01:00 Commit: https://github.com/php/php-src/commit/bb0ab98b9d2f415caa35398099cecff8f3247ac3 Raw diff: https://github.com/php/php-src/commit/bb0ab98b9d2f415caa35398099cecff8f3247ac3.diff Zend: is_callable() wrongly accepts objects with no get_closure handler. Fix #23121 zend_is_callable_at_frame() tested get_closure && get_closure(...) == FAILURE, so a NULL handler short circuited past the error branch into the success path, leaving fcc->function_handler NULL. zend_fcc_addref() then asserted and call_user_func() dereferenced the null zend_function. Close GH-23123 Changed paths: A Zend/tests/gh23121.phpt M NEWS M Zend/zend_API.c Diff: diff --git a/NEWS b/NEWS index 8c84bee9f71f..447d052e21dc 100644 --- a/NEWS +++ b/NEWS @@ -7,6 +7,8 @@ PHP NEWS possible. (NickSdot) . Fixed GH-23083 (SEGV build_trace_args in zend_exceptions.c with -d error_include_args=On). (David Carlier) + . Fixed GH-23121 (is_callable() wrongly accepts objects with no get_closure + handler). (David Carlier) - Curl: . Improved cURL option validation errors to include the option name. diff --git a/Zend/tests/gh23121.phpt b/Zend/tests/gh23121.phpt new file mode 100644 index 000000000000..158794ba04e3 --- /dev/null +++ b/Zend/tests/gh23121.phpt @@ -0,0 +1,36 @@ +--TEST-- +GH-23121 (Assertion failure in zend_fcc_addref() for an object whose class has no get_closure handler) +--EXTENSIONS-- +simplexml +--FILE-- +<?php +$sxe = new SimpleXMLElement('<root/>'); + +var_dump(is_callable($sxe)); + +try { + $sxe(); +} catch (Error $e) { + echo $e->getMessage(), PHP_EOL; +} + +try { + call_user_func($sxe); +} catch (TypeError $e) { + echo $e->getMessage(), PHP_EOL; +} + +try { + libxml_set_external_entity_loader($sxe); +} catch (TypeError $e) { + echo $e->getMessage(), PHP_EOL; +} + +var_dump(libxml_get_external_entity_loader()); +?> +--EXPECT-- +bool(false) +Object of type SimpleXMLElement is not callable +call_user_func(): Argument #1 ($callback) must be a valid callback, no array or string given +libxml_set_external_entity_loader(): Argument #1 ($resolver_function) must be a valid callback or null, no array or string given +NULL diff --git a/Zend/zend_API.c b/Zend/zend_API.c index de3570c5e848..7d407f7e9053 100644 --- a/Zend/zend_API.c +++ b/Zend/zend_API.c @@ -4240,7 +4240,7 @@ ZEND_API bool zend_is_callable_at_frame( } case IS_OBJECT: - if (Z_OBJ_HANDLER_P(callable, get_closure) && Z_OBJ_HANDLER_P(callable, get_closure)(Z_OBJ_P(callable), &fcc->calling_scope, &fcc->function_handler, &fcc->object, 1) == FAILURE) { + if (!Z_OBJ_HANDLER_P(callable, get_closure) || Z_OBJ_HANDLER_P(callable, get_closure)(Z_OBJ_P(callable), &fcc->calling_scope, &fcc->function_handler, &fcc->object, 1) == FAILURE) { if (error) *error = estrdup("no array or string given"); return 0; }