From: Nikita Popov <nikic@php.net>
Date: Wed, 20 Apr 2016 16:37:23 +0000 (+0200)
Subject: Fix bug #71737
X-Git-Tag: php-7.0.7RC1~88
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=77bb96d7c95ddfdba8b16325db439913ee58522f;p=php

Fix bug #71737

Also improve the error message for $this used in parameters.
---

diff --git a/NEWS b/NEWS
index 69155799a0..93ca10836b 100644
--- a/NEWS
+++ b/NEWS
@@ -7,6 +7,8 @@ PHP                                                                        NEWS
     (Nikita Nefedov)
   . Fixed bug #72038 (Function calls with values to a by-ref parameter don't
     always throw a notice). (Bob)
+  . Fixed bug #71737 (Memory leak in closure with parameter named $this).
+    (Nikita)
 
 - OCI8:
   . Fixed bug #71600 (oci_fetch_all segfaults when selecting more than eight
diff --git a/Zend/tests/bug41117_1.phpt b/Zend/tests/bug41117_1.phpt
index f555b637ad..a612f07fed 100644
--- a/Zend/tests/bug41117_1.phpt
+++ b/Zend/tests/bug41117_1.phpt
@@ -10,5 +10,4 @@ class foo {
 $obj = new foo("Hello world");
 ?>
 --EXPECTF--
-Fatal error: Cannot re-assign $this in %sbug41117_1.php on line 3
-
+Fatal error: Cannot use $this as parameter in %s on line %d
diff --git a/Zend/tests/bug71737.phpt b/Zend/tests/bug71737.phpt
new file mode 100644
index 0000000000..b44de8e78e
--- /dev/null
+++ b/Zend/tests/bug71737.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #71737: Memory leak in closure with parameter named $this
+--FILE--
+<?php
+
+class Test {
+    public function method() {
+        return function($this) {};
+    }
+}
+
+(new Test)->method()(new stdClass);
+
+?>
+--EXPECTF--
+Fatal error: Cannot use $this as parameter in %s on line %d
diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 13e774eaba..89fd0e520e 100644
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -4484,8 +4484,9 @@ void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast) /* {{{ */
 			zend_error_noreturn(E_COMPILE_ERROR, "Redefinition of parameter $%s",
 				ZSTR_VAL(name));
 		} else if (zend_string_equals_literal(name, "this")) {
-			if (op_array->scope && (op_array->fn_flags & ZEND_ACC_STATIC) == 0) {
-				zend_error_noreturn(E_COMPILE_ERROR, "Cannot re-assign $this");
+			if ((op_array->scope || (op_array->fn_flags & ZEND_ACC_CLOSURE))
+					&& (op_array->fn_flags & ZEND_ACC_STATIC) == 0) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Cannot use $this as parameter");
 			}
 			op_array->this_var = var_node.u.op.var;
 		}