Fixed bug #37138 (__autoload tries to load callback'ed self and parent)

diff --git a/NEWS b/NEWS
index 80ed4314a3cef8a2d7f06c7600dead7e684a539b..4775397628d4e131df140c68398005a2f8ef2b16 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Apr 2006, PHP 5.1.3
+- Fixed bug #37138 (__autoload tries to load callback'ed self and parent).
+  (Dmitry)
 - Fixed bug #37103 (libmbfl headers not installed). (Jani)
 - Fixed bug #37083 (Frequent crashs in SOAP extension with new WSDL caching
   code in multithread WS). (Andrei, Dmitry)

diff --git a/Zend/tests/bug37138.phpt b/Zend/tests/bug37138.phpt
new file mode 100755 (executable)
index 0000000..f8503f8
--- /dev/null
+++ b/Zend/tests/bug37138.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #37138 (__autoload tries to load callback'ed self and parent)
+--FILE--
+<?php
+function __autoload ($CN) {var_dump ($CN);}
+class st {
+       public static function e () {echo ("EHLO\n");}
+       public static function e2 () {call_user_func (array ('self', 'e'));}
+}
+class stch extends st {
+       public static function g () {call_user_func (array ('parent', 'e'));}
+}
+st::e ();
+st::e2 ();
+stch::g ();
+?>
+--EXPECT--
+EHLO
+EHLO
+EHLO
+

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 71f3a504ffd27a53a2472a05e3ccf01483299432..0a9b8213a004bb36bb60ef68b4174690aa77dbe2 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2039,18 +2039,16 @@ static int zend_is_callable_check_func(int check_flags, zval ***zobj_ptr_ptr, ze
        if ((colon = strstr(Z_STRVAL_P(callable), "::")) != NULL) {
                clen = colon - Z_STRVAL_P(callable);
                mlen = Z_STRLEN_P(callable) - clen - 2;
-               if (zend_lookup_class(Z_STRVAL_P(callable), clen, &pce TSRMLS_CC) == SUCCESS) {
+               lcname = zend_str_tolower_dup(Z_STRVAL_P(callable), clen);
+               /* caution: lcname is not '\0' terminated */
+               if (clen == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self") - 1) == 0) {
+                       *ce_ptr = EG(scope);
+               } else if (clen == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent") - 1) == 0 && EG(active_op_array)->scope) {
+                       *ce_ptr = EG(scope) ? EG(scope)->parent : NULL;
+               } else if (zend_lookup_class(Z_STRVAL_P(callable), clen, &pce TSRMLS_CC) == SUCCESS) {
                        *ce_ptr = *pce;
-               } else {
-                       lcname = zend_str_tolower_dup(Z_STRVAL_P(callable), clen);
-                       /* caution: lcname is not '\0' terminated */
-                       if (clen == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self") - 1) == 0) {
-                               *ce_ptr = EG(scope);
-                       } else if (clen == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent") - 1) == 0 && EG(active_op_array)->scope) {
-                               *ce_ptr = EG(scope) ? EG(scope)->parent : NULL;
-                       }
-                       efree(lcname);
                }
+               efree(lcname);
                if (!*ce_ptr) {
                        return 0;
                }
@@ -2179,17 +2177,15 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, uint check_flags, char **
                                                        return 1;
                                                }
 
-                                               if (zend_lookup_class(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), &pce TSRMLS_CC) == SUCCESS) {
+                                               lcname = zend_str_tolower_dup(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj));
+                                               if (Z_STRLEN_PP(obj) == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self")) == 0) {
+                                                       ce = EG(active_op_array)->scope;
+                                               } else if (Z_STRLEN_PP(obj) == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent")) == 0 && EG(active_op_array)->scope) {
+                                                       ce = EG(active_op_array)->scope->parent;
+                                               } else if (zend_lookup_class(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), &pce TSRMLS_CC) == SUCCESS) {
                                                        ce = *pce;
-                                               } else if (EG(active_op_array)) {
-                                                       lcname = zend_str_tolower_dup(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj));
-                                                       if (Z_STRLEN_PP(obj) == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self")) == 0) {
-                                                               ce = EG(active_op_array)->scope;
-                                                       } else if (Z_STRLEN_PP(obj) == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent")) == 0 && EG(active_op_array)->scope) {
-                                                               ce = EG(active_op_array)->scope->parent;
-                                                       }
-                                                       efree(lcname);
                                                }
+                                               efree(lcname);
                                        } else {
                                                ce = Z_OBJCE_PP(obj); /* TBFixed: what if it's overloaded? */