Added checks for destroied objects

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 2ec10b823932e237355cbdb187211cd9c8c6c3c7..2afb16576ced9c676380277e2e7e1416861ec9ae 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2573,6 +2573,15 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval **object_pp, uint ch
        fcc->calling_scope = NULL;
        fcc->object_pp = NULL;
 
+       if (object_pp && (!*object_pp ||  Z_TYPE_PP(object_pp) != IS_OBJECT)) {
+               object_pp = NULL;
+       }
+       if (object_pp &&
+           (!EG(objects_store).object_buckets || 
+            !EG(objects_store).object_buckets[Z_OBJ_HANDLE_PP(object_pp)].valid)) {
+               return 0;
+       }
+
        switch (Z_TYPE_P(callable)) {
                case IS_STRING:
                        if (object_pp && *object_pp) {
@@ -2648,6 +2657,11 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval **object_pp, uint ch
                                                }
 
                                        } else {
+                                               if (!EG(objects_store).object_buckets || 
+                                                   !EG(objects_store).object_buckets[Z_OBJ_HANDLE_PP(obj)].valid) {
+                                                       return 0;
+                                               }
+
                                                fcc->calling_scope = Z_OBJCE_PP(obj); /* TBFixed: what if it's overloaded? */
 
                                                fcc->object_pp = obj;

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 561bbdcf49fb544a6f0d3913fee8686b726c8d3b..ed57d740afabbd74097139e5c57e323a4b5859b6 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -744,7 +744,9 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
                        zend_error(E_STRICT, "%s", error);
                        efree(error);
                }
-               efree(callable_name);
+               if (callable_name) {
+                       efree(callable_name);
+               }
        }
 
        EX(function_state).function = fci_cache->function_handler;