MFH: fix #41421 (Uncaught exception from a stream wrapper segfaults)

diff --git a/Zend/tests/bug41421.phpt b/Zend/tests/bug41421.phpt
new file mode 100644 (file)
index 0000000..f10db10
--- /dev/null
+++ b/Zend/tests/bug41421.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Bug #41421 (Uncaught exception from a stream wrapper segfaults)
+--FILE--
+<?php
+
+class wrapper {
+       function stream_open() {
+               return true;
+       }
+       function stream_eof() {
+               throw new exception();
+       }
+}
+
+stream_wrapper_register("wrap", "wrapper");
+$fp = fopen("wrap://...", "r");
+feof($fp);
+
+echo "Done\n";
+?>
+--EXPECTF--    
+Warning: feof(): wrapper::stream_eof is not implemented! Assuming EOF in %s on line %d
+
+Fatal error: Uncaught exception 'Exception' in %s:%d
+Stack trace:
+#0 [internal function]: wrapper->stream_eof()
+#1 %s(%d): feof(Resource id #6)
+#2 {main}
+  thrown in %s on line %d

diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 7ca181a179204ab8b28ec3ca124748832521bc29..e49f9f5f3d774e3913622e0aeb8c5374e6efab36 100644 (file)
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -675,6 +675,10 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
                }
 
                if (fci->object_pp) {
+                       if (Z_TYPE_PP(fci->object_pp) == IS_OBJECT
+                               && (!EG(objects_store).object_buckets || !EG(objects_store).object_buckets[Z_OBJ_HANDLE_PP(fci->object_pp)].valid)) {
+                               return FAILURE;
+                       }
                        /* TBI!! new object handlers */
                        if (Z_TYPE_PP(fci->object_pp) == IS_OBJECT) {
                                if (!IS_ZEND_STD_OBJECT(**fci->object_pp)) {
@@ -839,6 +843,10 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
                calling_scope = fci_cache->calling_scope;
                fci->object_pp = fci_cache->object_pp;
                EX(object) = fci->object_pp ? *fci->object_pp : NULL;
+               if (fci->object_pp && Z_TYPE_PP(fci->object_pp) == IS_OBJECT
+                       && (!EG(objects_store).object_buckets || !EG(objects_store).object_buckets[Z_OBJ_HANDLE_PP(fci->object_pp)].valid)) {
+                       return FAILURE;
+               }
        }
 
        if (EX(function_state).function->common.fn_flags & (ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED)) {