Fixed bug #26697 (calling class_exists on a nonexistent class in __autoload

results in segfault).

diff --git a/NEWS b/NEWS
index 2d195be42aa3c17639bb95a3bf448e60f5a8102b..44fab3455baf75f40d851c2fc15c63cde102bdd0 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,8 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2004, PHP 5 RC 1
 - Preserve class name casing for userspace classes. (Marcus)
+- Fixed bug #26697 (calling class_exists on a nonexistent class in __autoload 
+  results in segfault). (Marcus)
 - Fixed bug #26695 (Reflection API does not recognize mixed-case class hints).
   (Marcus)
 - Fixed bug #26690 (make xsltProcessor->transformToUri use streams wrappers).

diff --git a/Zend/tests/bug26697.phpt b/Zend/tests/bug26697.phpt
new file mode 100755 (executable)
index 0000000..8266a23
--- /dev/null
+++ b/Zend/tests/bug26697.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Bug #26697 (calling class_exists on a nonexistent class in __autoload results in segfault)
+--SKIPIF--
+<?php if (function_exists('__autoload')) die('skip __autoload() declared in auto_prepend_file');?>
+--FILE--
+<?php
+
+function __autoload($name)
+{
+       echo __METHOD__ . "($name)\n";
+       var_dump(class_exists('NotExistingClass'));
+       echo __METHOD__ . "($name), done\n";
+}
+
+var_dump(class_exists('NotExistingClass'));
+
+?>
+===DONE===
+--EXPECTF--
+__autoload(NotExistingClass)
+bool(false)
+__autoload(NotExistingClass), done
+bool(false)
+===DONE===

diff --git a/Zend/zend.c b/Zend/zend.c
index cfaa46559017e2599b1eb9d4f54e7a6da19a0b80..a4fabb393b0559fa9a5167f961e230b8974e3c69 100644 (file)
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -472,6 +472,7 @@ static void executor_globals_ctor(zend_executor_globals *executor_globals TSRMLS
        EG(user_error_handler) = NULL;
        EG(user_exception_handler) = NULL;
        EG(in_execution) = 0;
+       EG(in_autoload) = 0;
        EG(current_execute_data) = NULL;
 }
 

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 0b8f8d3f05c16335e5d4d57d776115469f47d71e..058e713ff880eb3318d117d80c5dd925c7829fc5 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -138,6 +138,7 @@ void init_executor(TSRMLS_D)
        EG(class_table) = CG(class_table);
 
        EG(in_execution) = 0;
+       EG(in_autoload) = 0;
 
        zend_ptr_stack_init(&EG(argument_stack));
 
@@ -791,6 +792,12 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry ***
                return SUCCESS;
        }
 
+       if (EG(in_autoload)) {
+               free_alloca(lc_name);
+               return FAILURE;
+       }
+       EG(in_autoload) = 1;
+
        ZVAL_STRINGL(&autoload_function, "__autoload", sizeof("__autoload")-1,  0);
 
        INIT_PZVAL(class_name_ptr);
@@ -802,6 +809,8 @@ ZEND_API int zend_lookup_class(char *name, int name_length, zend_class_entry ***
        EG(exception) = NULL;
        retval = call_user_function_ex(EG(function_table), NULL, &autoload_function, &retval_ptr, 1, args, 0, NULL TSRMLS_CC);
 
+       EG(in_autoload) = 0;
+
        if (retval == FAILURE) {
                EG(exception) = exception;
                free_alloca(lc_name);

diff --git a/Zend/zend_globals.h b/Zend/zend_globals.h
index 95f3c8933d58d7189895c48b4f7e7bcf1737a3dd..16c5e7848c49b5785ae25dd85c3c555b85b45aef 100644 (file)
--- a/Zend/zend_globals.h
+++ b/Zend/zend_globals.h
@@ -191,6 +191,7 @@ struct _zend_executor_globals {
        int ticks_count;
 
        zend_bool in_execution;
+       zend_bool in_autoload;
        zend_bool bailout_set;
        zend_bool full_tables_cleanup;
        zend_bool implicit_clone;