svn: /php/php-src/ branches/PHP_5_3/NEWS branches/PHP_5_3/Zend/tests/bug54910.phpt branches/PHP_5_3/Zend/zend_API.c trunk/Zend/tests/bug54910.phpt
trunk/Zend/zend_API.c

dmitry Tue, 31 May 2011 09:20:51 +0000 Revision: http://svn.php.net/viewvc?view=revision&revision=311635 Log: Fixed bug #54910 (Crash when calling call_user_func with unknown function name) Bug: http://bugs.php.net/54910 (Assigned) Crash when calling call_user_func with unknown function name Changed paths: U php/php-src/branches/PHP_5_3/NEWS A php/php-src/branches/PHP_5_3/Zend/tests/bug54910.phpt U php/php-src/branches/PHP_5_3/Zend/zend_API.c A php/php-src/trunk/Zend/tests/bug54910.phpt U php/php-src/trunk/Zend/zend_API.c Modified: php/php-src/branches/PHP_5_3/NEWS =================================================================== --- php/php-src/branches/PHP_5_3/NEWS 2011-05-31 09:18:23 UTC (rev 311634) +++ php/php-src/branches/PHP_5_3/NEWS 2011-05-31 09:20:51 UTC (rev 311635) @@ -6,6 +6,8 @@ - Increased the backtrack limit from 100000 to 1000000 (Rasmus) - Zend Engine: + . Fixed bug #54910 (Crash when calling call_user_func with unknown function + name). (Dmitry) . Fixed bug #54804 (__halt_compiler and imported namespaces). (Pierrick, Felipe) . Fixed bug #54585 (track_errors causes segfault). (Dmitry) Added: php/php-src/branches/PHP_5_3/Zend/tests/bug54910.phpt =================================================================== --- php/php-src/branches/PHP_5_3/Zend/tests/bug54910.phpt (rev 0) +++ php/php-src/branches/PHP_5_3/Zend/tests/bug54910.phpt 2011-05-31 09:20:51 UTC (rev 311635) @@ -0,0 +1,28 @@ +--TEST-- +Bug #54910 (Crash when calling call_user_func with unknown function name) +--FILE-- +<?php +class A { + public function __call($method, $args) { + if (stripos($method, 'get') === 0) { + return $this->get(); + } + die("No such method - '$method'\n"); + } + + protected function get() { + $class = get_class($this); + $call = array($class, 'noSuchMethod'); + + if (is_callable($call)) { + call_user_func($call); + } + } +} + +class B extends A {} + +$input = new B(); +echo $input->getEmail(); +--EXPECT-- +No such method - 'noSuchMethod' Modified: php/php-src/branches/PHP_5_3/Zend/zend_API.c =================================================================== --- php/php-src/branches/PHP_5_3/Zend/zend_API.c 2011-05-31 09:18:23 UTC (rev 311634) +++ php/php-src/branches/PHP_5_3/Zend/zend_API.c 2011-05-31 09:20:51 UTC (rev 311635) @@ -2590,6 +2590,11 @@ if (fcc->function_handler) { retval = 1; call_via_handler = (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) != 0; + if (call_via_handler && !fcc->object_ptr && EG(This) && + Z_OBJ_HT_P(EG(This))->get_class_entry && + instanceof_function(Z_OBJCE_P(EG(This)), fcc->calling_scope TSRMLS_CC)) { + fcc->object_ptr = EG(This); + } } } } Added: php/php-src/trunk/Zend/tests/bug54910.phpt =================================================================== --- php/php-src/trunk/Zend/tests/bug54910.phpt (rev 0) +++ php/php-src/trunk/Zend/tests/bug54910.phpt 2011-05-31 09:20:51 UTC (rev 311635) @@ -0,0 +1,28 @@ +--TEST-- +Bug #54910 (Crash when calling call_user_func with unknown function name) +--FILE-- +<?php +class A { + public function __call($method, $args) { + if (stripos($method, 'get') === 0) { + return $this->get(); + } + die("No such method - '$method'\n"); + } + + protected function get() { + $class = get_class($this); + $call = array($class, 'noSuchMethod'); + + if (is_callable($call)) { + call_user_func($call); + } + } +} + +class B extends A {} + +$input = new B(); +echo $input->getEmail(); +--EXPECT-- +No such method - 'noSuchMethod' Modified: php/php-src/trunk/Zend/zend_API.c =================================================================== --- php/php-src/trunk/Zend/zend_API.c 2011-05-31 09:18:23 UTC (rev 311634) +++ php/php-src/trunk/Zend/zend_API.c 2011-05-31 09:20:51 UTC (rev 311635) @@ -2773,6 +2773,11 @@ if (fcc->function_handler) { retval = 1; call_via_handler = (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) != 0; + if (call_via_handler && !fcc->object_ptr && EG(This) && + Z_OBJ_HT_P(EG(This))->get_class_entry && + instanceof_function(Z_OBJCE_P(EG(This)), fcc->calling_scope TSRMLS_CC)) { + fcc->object_ptr = EG(This); + } } } }