From 9cf3e65391d6aa637e5471449499e957cff6ee89 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@php.net>
Date: Mon, 24 Jun 2013 23:45:08 +0800
Subject: [PATCH] Fixed bug (is_callable() triggers Fatal Error)

This bug is also exists in 5.4, and previous fix by dsp is not complete
for __callStatic stituation, see test script
---
 NEWS                     |  2 ++
 Zend/tests/bug65108.phpt | 27 +++++++++++++++++++++++++++
 Zend/zend_API.c          |  4 ++--
 3 files changed, 31 insertions(+), 2 deletions(-)
 create mode 100644 Zend/tests/bug65108.phpt

diff --git a/NEWS b/NEWS
index 9ec6740f2d..2dbe468d4d 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,8 @@ PHP                                                                        NEWS
 ?? ??? 2013, PHP 5.4.18
 
 - Core:
+  . Fixed bug #65108 (is_callable() triggers Fatal Error). 
+    (David Soria Parra, Laruence)
   . Fixed bug #65088 (Generated configure script is malformed on OpenBSD).
     (Adam)
 
diff --git a/Zend/tests/bug65108.phpt b/Zend/tests/bug65108.phpt
new file mode 100644
index 0000000000..d3e5a65b26
--- /dev/null
+++ b/Zend/tests/bug65108.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #65108 (is_callable() triggers Fatal Error)
+--FILE--
+<?php
+class C {
+	private function f() {}
+	static function __callStatic($name, $args) {}
+}
+
+class B {
+	public function B() {
+		$isCallable = is_callable(array(new C, 'f'));
+		var_dump($isCallable);
+	}
+}
+
+new B();
+
+Class E {
+   private function f() {}
+   function __call($name, $args) {}
+}
+$isCallable = is_callable(array('E', 'f'));
+var_dump($isCallable);
+--EXPECT--
+bool(false)
+bool(false)
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index e1f80c7171..90d27b7987 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2779,8 +2779,8 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 		}
 		if ((check_flags & IS_CALLABLE_CHECK_NO_ACCESS) == 0 &&
 		    (fcc->calling_scope &&
-		     (fcc->calling_scope->__call ||
-		      fcc->calling_scope->__callstatic))) {
+		     ((fcc->object_ptr && fcc->calling_scope->__call) ||
+		      (!fcc->object_ptr && fcc->calling_scope->__callstatic)))) {
 			if (fcc->function_handler->op_array.fn_flags & ZEND_ACC_PRIVATE) {
 				if (!zend_check_private(fcc->function_handler, fcc->object_ptr ? Z_OBJCE_P(fcc->object_ptr) : EG(scope), lmname, mlen TSRMLS_CC)) {
 					retval = 0;
-- 
2.40.0