From: Xinchen Hui <laruence@gmail.com>
Date: Thu, 12 Nov 2015 06:35:34 +0000 (+0800)
Subject: Re-fixed #70895
X-Git-Tag: php-7.0.1RC1~93
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=53c03115cfe81780f6ec5647b5d75f01fb8511f5;p=php

Re-fixed #70895
---

diff --git a/NEWS b/NEWS
index 77c0010b37..3ac684a23c 100644
--- a/NEWS
+++ b/NEWS
@@ -4,7 +4,7 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed bug #70895 (null ptr deref and segfault with crafted calable).
-    (Anatol)
+    (Anatol, Laruence)
 
 - Streams/Socket
   . Add IPV6_V6ONLY constant / make it usable in stream contexts. (Bob)
diff --git a/Zend/tests/bug70895.phpt b/Zend/tests/bug70895.phpt
new file mode 100644
index 0000000000..e6df09c9ac
--- /dev/null
+++ b/Zend/tests/bug70895.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #70895 null ptr deref and segfault with crafted calable
+--FILE--
+<?php
+
+array_map("%n", 0);
+array_map("%n %i", 0);
+array_map("%n %i aoeu %f aoeu %p", 0);
+?>
+--EXPECTREGEX--
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n' not found or invalid function name in .+
+
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i' not found or invalid function name in .+
+
+Warning: array_map\(\) expects parameter 1 to be a valid callback, function '%n %i aoeu %f aoeu %p' not found or invalid function name in .+bug70895.php on line \d+
diff --git a/Zend/zend.c b/Zend/zend.c
index 27e807067f..ab14372f6b 100644
--- a/Zend/zend.c
+++ b/Zend/zend.c
@@ -1346,7 +1346,7 @@ ZEND_API ZEND_COLD void zend_internal_type_error(zend_bool throw_exception, cons
 	if (throw_exception) {
 		zend_throw_exception(zend_ce_type_error, message, 0);
 	} else {
-		zend_error(E_WARNING, message);
+		zend_error(E_WARNING, "%s", message);
 	}
 	efree(message);