From: Nikita Popov <nikic@php.net>
Date: Fri, 9 Oct 2015 21:01:23 +0000 (+0200)
Subject: Fixed bug #70681
X-Git-Tag: php-5.6.15RC1~4
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bbae7ddf29192af25a3a776dfc52508c162d2ea6;p=php

Fixed bug #70681
---

diff --git a/NEWS b/NEWS
index c5589c1119..90369ebce4 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2015, PHP 5.6.15
 
+- Core:
+  . Fixed bug #70681 (Segfault when binding $this of internal instance method
+    to null). (Nikita)
+
 - Date:
   . Fixed bug #70619 (DateTimeImmutable segfault). (Laruence)
 
diff --git a/Zend/tests/bug70681.phpt b/Zend/tests/bug70681.phpt
new file mode 100644
index 0000000000..a99180b0ce
--- /dev/null
+++ b/Zend/tests/bug70681.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #70681: Segfault when binding $this of internal instance method to null
+--FILE--
+<?php
+
+$c = (new ReflectionMethod('SplStack', 'count'))->getClosure(new SplStack);
+$c = $c->bindTo(null);
+
+?>
+--EXPECTF--
+Warning: Cannot unbind $this of internal method in %s on line %d
diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
index 90d7eaf8c0..772eb12ecc 100644
--- a/Zend/zend_closures.c
+++ b/Zend/zend_closures.c
@@ -88,6 +88,12 @@ ZEND_METHOD(Closure, bind)
 		zend_error(E_WARNING, "Cannot bind an instance to a static closure");
 	}
 
+	if (newthis == NULL && !(closure->func.common.fn_flags & ZEND_ACC_STATIC)
+			&& closure->func.type == ZEND_INTERNAL_FUNCTION) {
+		zend_error(E_WARNING, "Cannot unbind $this of internal method");
+		return;
+	}
+
 	if (scope_arg != NULL) { /* scope argument was given */
 		if (IS_ZEND_STD_OBJECT(*scope_arg)) {
 			ce = Z_OBJCE_P(scope_arg);