- MFH Fix SEGV if get_method() returns a non bound function

diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index 809227230a9fd1b0bd38e6bd70b24e257fec488d..512e5bcf7a92aaf56036a0e18cca0d7a2736439f 100644 (file)
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -1752,7 +1752,7 @@ ZEND_VM_HANDLER(112, ZEND_INIT_METHOD_CALL, TMP|VAR|UNUSED|CV, CONST|TMP|VAR|CV)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {

diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 3bf275e0ed7e284487321165e3ad1ee01708cfbc..d9bc3ec88039bd26520f10d2b53581b52d21bd5a 100644 (file)
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -5354,7 +5354,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -5799,7 +5799,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -6246,7 +6246,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -6787,7 +6787,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -9435,7 +9435,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -10955,7 +10955,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -12525,7 +12525,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -14540,7 +14540,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -15716,7 +15716,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_A
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -16740,7 +16740,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -17720,7 +17720,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -18965,7 +18965,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -21590,7 +21590,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -23102,7 +23102,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -24663,7 +24663,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {
@@ -26668,7 +26668,7 @@ static int ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
                zend_error_noreturn(E_ERROR, "Call to a member function %s() on a non-object", function_name_strval);
        }
 
-       if (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) {
+       if (!EX(object) || (EX(fbc) && (EX(fbc)->common.fn_flags & ZEND_ACC_STATIC) != 0)) {
                EX(object) = NULL;
        } else {
                if (!PZVAL_IS_REF(EX(object))) {