Re-fixed #70895

diff --git a/NEWS b/NEWS
index 77c0010b3771b303d730eb2585960f80224caad5..3ac684a23ca8c618101d099b045c19c5d5755f5d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,7 +4,7 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed bug #70895 (null ptr deref and segfault with crafted calable).
-    (Anatol)
+    (Anatol, Laruence)
 
 - Streams/Socket
   . Add IPV6_V6ONLY constant / make it usable in stream contexts. (Bob)

diff --git a/Zend/tests/bug70895.phpt b/Zend/tests/bug70895.phpt
new file mode 100644 (file)
index 0000000..e6df09c
--- /dev/null
+++ b/Zend/tests/bug70895.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #70895 null ptr deref and segfault with crafted calable
+--FILE--
+<?php
+
+array_map("%n", 0);
+array_map("%n %i", 0);
+array_map("%n %i aoeu %f aoeu %p", 0);
+?>
+--EXPECTREGEX--
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n' not found or invalid function name in .+
+
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i' not found or invalid function name in .+
+
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i aoeu %f aoeu %p' not found or invalid function name in .+bug70895.php on line \d+

diff --git a/Zend/zend.c b/Zend/zend.c
index 27e807067f86d44f77a5cf9a31530767d88effc4..ab14372f6b6f30668c7b7f3ee203e7cc7b41f1f8 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -1346,7 +1346,7 @@ ZEND_API ZEND_COLD void zend_internal_type_error(zend_bool throw_exception, cons
        if (throw_exception) {
                zend_throw_exception(zend_ce_type_error, message, 0);
        } else {
-               zend_error(E_WARNING, message);
+               zend_error(E_WARNING, "%s", message);
        }
        efree(message);