Fix bug #63173: Crash when invoking invalid array callback

The code did not check whether the zend_hash_index_find calls succeded,
so PHP crashed when an array callback was called that contains two elements
which don't have the indices 0 and 1.

diff --git a/Zend/tests/bug63173.phpt b/Zend/tests/bug63173.phpt
new file mode 100644 (file)
index 0000000..36ebf20
--- /dev/null
+++ b/Zend/tests/bug63173.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #63173: Crash when invoking invalid array callback
+--FILE--
+<?php
+
+// the important part here are the indexes 1 and 2
+$callback = [1 => 0, 2 => 0];
+$callback();
+
+?>
+--EXPECTF--
+Fatal error: Array callback has to contain indices 0 and 1 in %s on line %d

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index f5567ea990e2e2c54fe47b3b751c3df8f37354f3..9d475a688c64db573a8872117dc84e1fac70d9cc 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -2412,6 +2412,10 @@ ZEND_VM_HANDLER(59, ZEND_INIT_FCALL_BY_NAME, ANY, CONST|TMP|VAR|CV)
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
 
+                       if (!obj || !method) {
+                               zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
+                       }
+
                        if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
                                zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
                        }

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 78f3d8496d8784698261a743fbd845d621c5031e..4abe6503cdf8a9893f1b1e6a0c7e5c94dbfc65d6 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -1256,6 +1256,10 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_CONST_HANDLER(ZEND_OPCODE
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
 
+                       if (!obj || !method) {
+                               zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
+                       }
+
                        if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
                                zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
                        }
@@ -1558,6 +1562,10 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_TMP_HANDLER(ZEND_OPCODE_H
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
 
+                       if (!obj || !method) {
+                               zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
+                       }
+
                        if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
                                zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
                        }
@@ -1722,6 +1730,10 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_VAR_HANDLER(ZEND_OPCODE_H
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
 
+                       if (!obj || !method) {
+                               zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
+                       }
+
                        if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
                                zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
                        }
@@ -1919,6 +1931,10 @@ static int ZEND_FASTCALL  ZEND_INIT_FCALL_BY_NAME_SPEC_CV_HANDLER(ZEND_OPCODE_HA
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 0, (void **) &obj);
                        zend_hash_index_find(Z_ARRVAL_P(function_name), 1, (void **) &method);
 
+                       if (!obj || !method) {
+                               zend_error_noreturn(E_ERROR, "Array callback has to contain indices 0 and 1");
+                       }
+
                        if (Z_TYPE_PP(obj) != IS_STRING && Z_TYPE_PP(obj) != IS_OBJECT) {
                                zend_error_noreturn(E_ERROR, "First array member is not a valid class name or object");
                        }