Fixed bug (is_callable() triggers Fatal Error)

This bug is also exists in 5.4, and previous fix by dsp is not complete
for __callStatic stituation, see test script

diff --git a/NEWS b/NEWS
index 9ec6740f2dd79321907ddcb56178e35a0f00cbbb..2dbe468d4da9225c5dab205f97b6d3c207486d58 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2013, PHP 5.4.18
 
 - Core:
+  . Fixed bug #65108 (is_callable() triggers Fatal Error). 
+    (David Soria Parra, Laruence)
   . Fixed bug #65088 (Generated configure script is malformed on OpenBSD).
     (Adam)
 

diff --git a/Zend/tests/bug65108.phpt b/Zend/tests/bug65108.phpt
new file mode 100644 (file)
index 0000000..d3e5a65
--- /dev/null
+++ b/Zend/tests/bug65108.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #65108 (is_callable() triggers Fatal Error)
+--FILE--
+<?php
+class C {
+       private function f() {}
+       static function __callStatic($name, $args) {}
+}
+
+class B {
+       public function B() {
+               $isCallable = is_callable(array(new C, 'f'));
+               var_dump($isCallable);
+       }
+}
+
+new B();
+
+Class E {
+   private function f() {}
+   function __call($name, $args) {}
+}
+$isCallable = is_callable(array('E', 'f'));
+var_dump($isCallable);
+--EXPECT--
+bool(false)
+bool(false)

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index e1f80c71710a47f7194a92f6d60e7fd2a1469985..90d27b79878b74cc12cd0b22d4ac67be8358ff97 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2779,8 +2779,8 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
                }
                if ((check_flags & IS_CALLABLE_CHECK_NO_ACCESS) == 0 &&
                    (fcc->calling_scope &&
-                    (fcc->calling_scope->__call ||
-                     fcc->calling_scope->__callstatic))) {
+                    ((fcc->object_ptr && fcc->calling_scope->__call) ||
+                     (!fcc->object_ptr && fcc->calling_scope->__callstatic)))) {
                        if (fcc->function_handler->op_array.fn_flags & ZEND_ACC_PRIVATE) {
                                if (!zend_check_private(fcc->function_handler, fcc->object_ptr ? Z_OBJCE_P(fcc->object_ptr) : EG(scope), lmname, mlen TSRMLS_CC)) {
                                        retval = 0;