- MFH Fix SEGV if get_method() returns a non bound function

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index f759ecf49418d1247b843da26b7bd5758d56cea4..4c166a8009376deee7e3cf43497c1dd077f60928 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1926,11 +1926,11 @@ ZEND_VM_HANDLER(112, ZEND_INIT_METHOD_CALL, TMP|VAR|UNUSED|CV, CONST|TMP|VAR|CV)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index d479f0dc1fa6adddd3aba077ed8b3bddca2f8081..54ce1cdd87dc84fc947447f2ed069010fbb0e018 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -5917,11 +5917,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_CONST_HANDLER(ZEND_OPCO
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -6381,11 +6381,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -6847,11 +6847,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -7405,11 +7405,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -10255,11 +10255,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCO
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -12086,11 +12086,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -13913,11 +13913,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -16348,11 +16348,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -17715,11 +17715,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER(ZEND_O
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -18845,11 +18845,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPC
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -19919,11 +19919,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPC
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -21263,11 +21263,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCO
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -24100,11 +24100,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER(ZEND_OPCOD
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -25762,11 +25762,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -27476,11 +27476,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {
@@ -29696,11 +29696,11 @@ static int ZEND_FASTCALL  ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_H
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       EX(called_scope) = Z_OBJCE_P(EX(object));
-
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0) {
+               EX(called_scope) = NULL;
                EX(object) = NULL;
        } else {
+               EX(called_scope) = Z_OBJCE_P(EX(object));
                if (!PZVAL_IS_REF(EX(object))) {
                        Z_ADDREF_P(EX(object)); /* For $this pointer */
                } else {