- Fixed invalid free in call_user_method() function

diff --git a/NEWS b/NEWS
index 46a1f662690972412470040c734ff46e594628c3..784a8f7589bfd23de14d2fb192c83d1c6a68e3aa 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,7 @@ PHP                                                                        NEWS
     (klightspeed at netspace dot net dot au)
   . Fixed bug #52624 (tempnam() by-pass open_basedir with nonnexistent
     directory). (Felipe)
+  . Fixed invalid free in call_user_method() function. (Felipe)
     
 - Zend Engine:
   . Fixed bug #43200 (Interface implementation / inheritence not possible in

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 58e36c3cffdf4cc55e1cf38f227307c8404ef116..ba8b121f1efaf813279d16d68a62dcda76049a34 100644 (file)
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -4825,7 +4825,9 @@ PHP_FUNCTION(call_user_method)
                Z_TYPE_P(object) != IS_STRING
        ) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Second argument is not an object or class name");
-               efree(params);
+               if (params) {
+                       efree(params);
+               }
                RETURN_FALSE;
        }
 

diff --git a/ext/standard/tests/general_functions/call_user_method_002.phpt b/ext/standard/tests/general_functions/call_user_method_002.phpt
new file mode 100644 (file)
index 0000000..054bc3e
--- /dev/null
+++ b/ext/standard/tests/general_functions/call_user_method_002.phpt
@@ -0,0 +1,12 @@
+--TEST--
+call_user_method() Invalid free
+--FILE--
+<?php
+
+call_user_method("1", $arr1);
+
+?>
+--EXPECTF--
+Deprecated: Function call_user_method() is deprecated in %s on line %d
+
+Warning: call_user_method(): Second argument is not an object or class name in %s on line %d