Fixed bug #70630 (Closure::call/bind() crash with ReflectionFunction->getClosure())

diff --git a/NEWS b/NEWS
index 3410a6d5f1b361784c16dfde58e2c5b9acc98a8f..abf828e4ebae22f94306ec596aa9d5fa22ada536 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 15 Oct 2015, PHP 7.0.0 RC 5
 
 - Core:
+  . Fixed bug #70630 (Closure::call/bind() crash with ReflectionFunction->
+    getClosure()). (Dmitry, Bob)
   . Fixed bug #70662 (Duplicate array key via undefined index error handler).
     (Nikita)
 

diff --git a/Zend/tests/bug70630.phpt b/Zend/tests/bug70630.phpt
new file mode 100644 (file)
index 0000000..fc79949
--- /dev/null
+++ b/Zend/tests/bug70630.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #70630 (Closure::call/bind() crash with ReflectionFunction->getClosure())
+--FILE--
+<?php
+class a {}
+$x = (new ReflectionFunction("substr"))->getClosure();
+$x->call(new a);
+?>
+--EXPECTF--
+Warning: a::substr() expects at least 2 parameters, 0 given in %s on line %d

diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
index a394c91c60b0db7723068777d4d9cbe34ca110d2..4430e7b25061aaefe3973ee7fcbc73dbb60cd3f1 100644 (file)
--- a/Zend/zend_closures.c
+++ b/Zend/zend_closures.c
@@ -98,6 +98,7 @@ ZEND_METHOD(Closure, call)
        if (closure->func.type == ZEND_INTERNAL_FUNCTION) {
                /* verify that we aren't binding internal function to a wrong object */
                if ((closure->func.common.fn_flags & ZEND_ACC_STATIC) == 0 &&
+                               closure->func.common.scope &&
                                !instanceof_function(Z_OBJCE_P(newthis), closure->func.common.scope)) {
                        zend_error(E_WARNING, "Cannot bind function %s::%s to object of class %s", ZSTR_VAL(closure->func.common.scope->name), ZSTR_VAL(closure->func.common.function_name), ZSTR_VAL(Z_OBJCE_P(newthis)->name));
                        return;