From: Nikita Popov <nikita.ppv@gmail.com>
Date: Wed, 9 Oct 2019 14:59:38 +0000 (+0200)
Subject: Fixed bug #78658
X-Git-Tag: php-7.4.0RC4~27^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6fd6ad8f53f68154fa23de25f400d89ae29d54d0;p=php

Fixed bug #78658
---

diff --git a/NEWS b/NEWS
index b7d193ab58..e96d88f4c1 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.12
 
+- Core:
+  . Fixed bug #78658 (Memory corruption using Closure::bindTo). (Nikita)
+
 - Iconv:
   . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
     cmb).
diff --git a/Zend/tests/bug78658.phpt b/Zend/tests/bug78658.phpt
new file mode 100644
index 0000000000..3445b98b09
--- /dev/null
+++ b/Zend/tests/bug78658.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #78658: Memory corruption using Closure::bindTo()
+--FILE--
+<?php
+
+$c = function(){};
+
+$scope = "AAAA";
+$scope = "{$scope}BBBB";
+$c->bindTo(new stdClass, $scope);
+
+?>
+--EXPECTF--
+Warning: Class 'AAAABBBB' not found in %s on line %d
diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
index ac63826262..fce69f12ff 100644
--- a/Zend/zend_closures.c
+++ b/Zend/zend_closures.c
@@ -200,7 +200,7 @@ ZEND_METHOD(Closure, bind)
 				ce = closure->func.common.scope;
 			} else if ((ce = zend_lookup_class_ex(class_name, NULL, 1)) == NULL) {
 				zend_error(E_WARNING, "Class '%s' not found", ZSTR_VAL(class_name));
-				zend_string_release_ex(class_name, 0);
+				zend_tmp_string_release(tmp_class_name);
 				RETURN_NULL();
 			}
 			zend_tmp_string_release(tmp_class_name);