From: Dmitry Stogov <dmitry@php.net>
Date: Tue, 25 Dec 2007 10:58:30 +0000 (+0000)
Subject: Fixed bug #43651 (is_callable() with one or more nonconsecutive colons crashes)
X-Git-Tag: RELEASE_1_3_1~471
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=43f6392e9009eb45f56b069c4bfd82774423fe09;p=php

Fixed bug #43651 (is_callable() with one or more nonconsecutive colons crashes)
---

diff --git a/Zend/tests/bug43651.phpt b/Zend/tests/bug43651.phpt
new file mode 100644
index 0000000000..bce0601abe
--- /dev/null
+++ b/Zend/tests/bug43651.phpt
@@ -0,0 +1,41 @@
+--TEST--
+Bug #43651 (is_callable() with one or more nonconsecutive colons crashes)
+--FILE--
+<?php
+class Test {
+    static function foo() {}
+}
+
+var_dump(is_callable("::"));
+var_dump(is_callable(":"));
+var_dump(is_callable("x:"));
+var_dump(is_callable(":x"));
+var_dump(is_callable("x:x"));
+var_dump(is_callable("x::"));
+var_dump(is_callable("::x"));
+var_dump(is_callable("x::x"));
+var_dump(is_callable("cd"));
+var_dump(is_callable("Test::"));
+var_dump(is_callable("::Test"));
+var_dump(is_callable("::Test::"));
+var_dump(is_callable("Test::foo"));
+var_dump(is_callable("::Test::foo"));
+var_dump(is_callable("is_string"));
+var_dump(is_callable("::is_string"));
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index d852d2e689..017fb2657c 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2328,15 +2328,14 @@ static int zend_is_callable_check_func(int check_flags, zval ***zobj_ptr_ptr, ze
 		clen = colon - Z_STRVAL_P(callable);
 		mlen = Z_STRLEN_P(callable) - clen - 2;
 		lmname = colon + 2;
-	}
-	if (colon && colon == Z_STRVAL_P(callable)) {
-		return 0;
-	}
 
- 	if (colon != NULL) {
+		if (colon == Z_STRVAL_P(callable)) {
+			return 0;
+		}
+
 		/* This is a compound name.
 		 * Try to fetch class and then find static method. */
- 		*ce_ptr = zend_fetch_class(Z_STRVAL_P(callable), clen, ZEND_FETCH_CLASS_AUTO TSRMLS_CC);
+ 		*ce_ptr = zend_fetch_class(Z_STRVAL_P(callable), clen, ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_SILENT TSRMLS_CC);
 		if (!*ce_ptr) {
 			return 0;
 		}
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index a6aceb5f13..cadfd25f5c 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -825,12 +825,11 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 				colon > fname &&
 				*(colon - 1) == ':'
 			) {
+				zend_class_entry **pce, *ce_child = NULL;
+
 				clen = colon - fname - 1;
 				fname_len -= (clen + 2);
 				fname = colon + 1;
-			}
-			if (colon != NULL) {
-				zend_class_entry **pce, *ce_child = NULL;
 		
 				lcname = zend_str_tolower_dup(cname, clen);
 				/* caution: lcname is not '\0' terminated */