From: Dmitry Stogov <dmitry@php.net>
Date: Thu, 20 Apr 2006 07:30:38 +0000 (+0000)
Subject: Fixed bug #37138 (__autoload tries to load callback'ed self and parent)
X-Git-Tag: php-5.1.3RC3~3
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bdef85af21146b462ebf8e13cf3a34162f02d7bd;p=php

Fixed bug #37138 (__autoload tries to load callback'ed self and parent)
---

diff --git a/NEWS b/NEWS
index 80ed4314a3..4775397628 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Apr 2006, PHP 5.1.3
+- Fixed bug #37138 (__autoload tries to load callback'ed self and parent).
+  (Dmitry)
 - Fixed bug #37103 (libmbfl headers not installed). (Jani)
 - Fixed bug #37083 (Frequent crashs in SOAP extension with new WSDL caching
   code in multithread WS). (Andrei, Dmitry)
diff --git a/Zend/tests/bug37138.phpt b/Zend/tests/bug37138.phpt
new file mode 100755
index 0000000000..f8503f8da9
--- /dev/null
+++ b/Zend/tests/bug37138.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #37138 (__autoload tries to load callback'ed self and parent)
+--FILE--
+<?php
+function __autoload ($CN) {var_dump ($CN);}
+class st {
+	public static function e () {echo ("EHLO\n");}
+	public static function e2 () {call_user_func (array ('self', 'e'));}
+}
+class stch extends st {
+	public static function g () {call_user_func (array ('parent', 'e'));}
+}
+st::e ();
+st::e2 ();
+stch::g ();
+?>
+--EXPECT--
+EHLO
+EHLO
+EHLO
+
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 71f3a504ff..0a9b8213a0 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2039,18 +2039,16 @@ static int zend_is_callable_check_func(int check_flags, zval ***zobj_ptr_ptr, ze
 	if ((colon = strstr(Z_STRVAL_P(callable), "::")) != NULL) {
 		clen = colon - Z_STRVAL_P(callable);
 		mlen = Z_STRLEN_P(callable) - clen - 2;
-		if (zend_lookup_class(Z_STRVAL_P(callable), clen, &pce TSRMLS_CC) == SUCCESS) {
+		lcname = zend_str_tolower_dup(Z_STRVAL_P(callable), clen);
+		/* caution: lcname is not '\0' terminated */
+		if (clen == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self") - 1) == 0) {
+			*ce_ptr = EG(scope);
+		} else if (clen == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent") - 1) == 0 && EG(active_op_array)->scope) {
+			*ce_ptr = EG(scope) ? EG(scope)->parent : NULL;
+		} else if (zend_lookup_class(Z_STRVAL_P(callable), clen, &pce TSRMLS_CC) == SUCCESS) {
 			*ce_ptr = *pce;
-		} else {
-			lcname = zend_str_tolower_dup(Z_STRVAL_P(callable), clen);
-			/* caution: lcname is not '\0' terminated */
-			if (clen == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self") - 1) == 0) {
-				*ce_ptr = EG(scope);
-			} else if (clen == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent") - 1) == 0 && EG(active_op_array)->scope) {
-				*ce_ptr = EG(scope) ? EG(scope)->parent : NULL;
-			}
-			efree(lcname);
 		}
+		efree(lcname);
 		if (!*ce_ptr) {
 			return 0;
 		}
@@ -2179,17 +2177,15 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, uint check_flags, char **
 							return 1;
 						}
 
-						if (zend_lookup_class(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), &pce TSRMLS_CC) == SUCCESS) {
+						lcname = zend_str_tolower_dup(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj));
+						if (Z_STRLEN_PP(obj) == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self")) == 0) {
+							ce = EG(active_op_array)->scope;
+						} else if (Z_STRLEN_PP(obj) == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent")) == 0 && EG(active_op_array)->scope) {
+							ce = EG(active_op_array)->scope->parent;
+						} else if (zend_lookup_class(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), &pce TSRMLS_CC) == SUCCESS) {
 							ce = *pce;
-						} else if (EG(active_op_array)) {
-							lcname = zend_str_tolower_dup(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj));
-							if (Z_STRLEN_PP(obj) == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self")) == 0) {
-								ce = EG(active_op_array)->scope;
-							} else if (Z_STRLEN_PP(obj) == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent")) == 0 && EG(active_op_array)->scope) {
-								ce = EG(active_op_array)->scope->parent;
-							}
-							efree(lcname);
 						}
+						efree(lcname);
 					} else {
 						ce = Z_OBJCE_PP(obj); /* TBFixed: what if it's overloaded? */