Fixed bug #70681

diff --git a/NEWS b/NEWS
index c5589c11190eee371ef6abb04c24ea1152fd23aa..90369ebce48c264b33e1c300328b214a7cc62476 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2015, PHP 5.6.15
 
+- Core:
+  . Fixed bug #70681 (Segfault when binding $this of internal instance method
+    to null). (Nikita)
+
 - Date:
   . Fixed bug #70619 (DateTimeImmutable segfault). (Laruence)
 

diff --git a/Zend/tests/bug70681.phpt b/Zend/tests/bug70681.phpt
new file mode 100644 (file)
index 0000000..a99180b
--- /dev/null
+++ b/Zend/tests/bug70681.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #70681: Segfault when binding $this of internal instance method to null
+--FILE--
+<?php
+
+$c = (new ReflectionMethod('SplStack', 'count'))->getClosure(new SplStack);
+$c = $c->bindTo(null);
+
+?>
+--EXPECTF--
+Warning: Cannot unbind $this of internal method in %s on line %d

diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
index 90d7eaf8c0f3581eeec954550d41cd3beec5d258..772eb12ecc002fc38c62b642342e102ed224670b 100644 (file)
--- a/Zend/zend_closures.c
+++ b/Zend/zend_closures.c
@@ -88,6 +88,12 @@ ZEND_METHOD(Closure, bind)
                zend_error(E_WARNING, "Cannot bind an instance to a static closure");
        }
 
+       if (newthis == NULL && !(closure->func.common.fn_flags & ZEND_ACC_STATIC)
+                       && closure->func.type == ZEND_INTERNAL_FUNCTION) {
+               zend_error(E_WARNING, "Cannot unbind $this of internal method");
+               return;
+       }
+
        if (scope_arg != NULL) { /* scope argument was given */
                if (IS_ZEND_STD_OBJECT(*scope_arg)) {
                        ce = Z_OBJCE_P(scope_arg);