Fixed bug #76536 (PHP crashes with core dump when throwing exception in error handler...

diff --git a/NEWS b/NEWS
index d5840d2d2537bc7358ddf196297fe13f162bb8a3..86fc1106bc5521d10698f00214afdbf520d98495 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -18,6 +18,10 @@ PHP                                                                        NEWS
 - phpdbg:
   . Fix arginfo wrt. optional/required parameters. (cmb)
 
+- Reflection:
+  . Fixed bug #76536 (PHP crashes with core dump when throwing exception in
+    error handler). (Laruence)
+
 - Standard:
   . Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys).
     (Laruence)

diff --git a/ext/reflection/php_reflection.c b/ext/reflection/php_reflection.c
index 7c6e20c07e8435a5148263b349668853c0057575..95b86e728368a10f2cbe24303bff2d3356fc9d1d 100644 (file)
--- a/ext/reflection/php_reflection.c
+++ b/ext/reflection/php_reflection.c
@@ -4617,7 +4617,7 @@ ZEND_METHOD(reflection_class, getConstants)
        ZEND_HASH_FOREACH_STR_KEY_PTR(&ce->constants_table, key, c) {
                if (UNEXPECTED(zval_update_constant_ex(&c->value, ce) != SUCCESS)) {
                        zend_array_destroy(Z_ARRVAL_P(return_value));
-                       return;
+                       RETURN_NULL();
                }
                val = zend_hash_add_new(Z_ARRVAL_P(return_value), key, &c->value);
                Z_TRY_ADDREF_P(val);

diff --git a/ext/reflection/tests/bug76536.phpt b/ext/reflection/tests/bug76536.phpt
new file mode 100644 (file)
index 0000000..9f3b3fd
--- /dev/null
+++ b/ext/reflection/tests/bug76536.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #76536 (PHP crashes with core dump when throwing exception in error handler)
+--FILE--
+<?php
+class SomeConstants {const SOME_CONSTANT = SOME_NONSENSE;}
+
+function handleError() {throw new ErrorException();}
+
+set_error_handler('handleError');
+set_exception_handler('handleError');
+
+$r = new \ReflectionClass(SomeConstants::class);
+$r->getConstants();
+?>
+--EXPECTF--
+Fatal error: Uncaught ErrorException in %sbug76536.php:%d
+Stack trace:
+#0 [internal function]: handleError(Object(ErrorException))
+#1 {main}
+  thrown in %sbug76536.php on line %d