Fixed bug #43651 (is_callable() with one or more nonconsecutive colons crashes)

diff --git a/Zend/tests/bug43651.phpt b/Zend/tests/bug43651.phpt
new file mode 100644 (file)
index 0000000..bce0601
--- /dev/null
+++ b/Zend/tests/bug43651.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #43651 (is_callable() with one or more nonconsecutive colons crashes)
+--FILE--
+<?php
+class Test {
+    static function foo() {}
+}
+
+var_dump(is_callable("::"));
+var_dump(is_callable(":"));
+var_dump(is_callable("x:"));
+var_dump(is_callable(":x"));
+var_dump(is_callable("x:x"));
+var_dump(is_callable("x::"));
+var_dump(is_callable("::x"));
+var_dump(is_callable("x::x"));
+var_dump(is_callable("cd"));
+var_dump(is_callable("Test::"));
+var_dump(is_callable("::Test"));
+var_dump(is_callable("::Test::"));
+var_dump(is_callable("Test::foo"));
+var_dump(is_callable("::Test::foo"));
+var_dump(is_callable("is_string"));
+var_dump(is_callable("::is_string"));
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(true)
+bool(true)
+bool(true)
+bool(true)

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index d852d2e689243ae63a3dad4df8581be843c04229..017fb2657c68f63a7cfa32e29bc6456c89a8e604 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2328,15 +2328,14 @@ static int zend_is_callable_check_func(int check_flags, zval ***zobj_ptr_ptr, ze
                clen = colon - Z_STRVAL_P(callable);
                mlen = Z_STRLEN_P(callable) - clen - 2;
                lmname = colon + 2;
-       }
-       if (colon && colon == Z_STRVAL_P(callable)) {
-               return 0;
-       }
 
-       if (colon != NULL) {
+               if (colon == Z_STRVAL_P(callable)) {
+                       return 0;
+               }
+
                /* This is a compound name.
                 * Try to fetch class and then find static method. */
-               *ce_ptr = zend_fetch_class(Z_STRVAL_P(callable), clen, ZEND_FETCH_CLASS_AUTO TSRMLS_CC);
+               *ce_ptr = zend_fetch_class(Z_STRVAL_P(callable), clen, ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_SILENT TSRMLS_CC);
                if (!*ce_ptr) {
                        return 0;
                }

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index a6aceb5f1366ccd8a093105f1de6eacc341b18e2..cadfd25f5c5be5937a94c43b9e20d016e1967fe3 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -825,12 +825,11 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
                                colon > fname &&
                                *(colon - 1) == ':'
                        ) {
+                               zend_class_entry **pce, *ce_child = NULL;
+
                                clen = colon - fname - 1;
                                fname_len -= (clen + 2);
                                fname = colon + 1;
-                       }
-                       if (colon != NULL) {
-                               zend_class_entry **pce, *ce_child = NULL;
                
                                lcname = zend_str_tolower_dup(cname, clen);
                                /* caution: lcname is not '\0' terminated */