From a680d701cece7d8c5d2b8aa1ce14bae4058b20da Mon Sep 17 00:00:00 2001 From: Nester Date: Mon, 18 Sep 2017 08:19:47 +0000 Subject: [PATCH] Fixed #75220 - Segfault when calling is_callable on parent --- NEWS | 2 ++ Zend/zend_API.c | 9 ++++++--- ext/standard/tests/bug75220.phpt | 28 ++++++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 3 deletions(-) create mode 100644 ext/standard/tests/bug75220.phpt diff --git a/NEWS b/NEWS index 37520dc7d3..c3c39bb418 100644 --- a/NEWS +++ b/NEWS @@ -8,6 +8,8 @@ PHP NEWS . Fixed bug #75236 (infinite loop when printing an error-message). (Andrea) . Fixed bug #75252 (Incorrect token formatting on two parse errors in one request). (Nikita) + . Fixed bug #75220 (Segfault when calling is_callable on parent). + (andrewnester) - SPL: . Fixed bug #73629 (SplDoublyLinkedList::setIteratorMode masks intern flags). diff --git a/Zend/zend_API.c b/Zend/zend_API.c index 262429c79d..d7b2279184 100644 --- a/Zend/zend_API.c +++ b/Zend/zend_API.c @@ -3067,7 +3067,8 @@ get_function_via_handler: (!fcc->function_handler->common.scope || !instanceof_function(ce_org, fcc->function_handler->common.scope))) { if (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) { - if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) { + if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && + fcc->function_handler->common.function_name) { zend_string_release(fcc->function_handler->common.function_name); } zend_free_trampoline(fcc->function_handler); @@ -3237,7 +3238,8 @@ again: ((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) || fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY || fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) { - if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) { + if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && + fcc->function_handler->common.function_name) { zend_string_release(fcc->function_handler->common.function_name); } zend_free_trampoline(fcc->function_handler); @@ -3324,7 +3326,8 @@ again: ((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) || fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY || fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) { - if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) { + if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && + fcc->function_handler->common.function_name) { zend_string_release(fcc->function_handler->common.function_name); } zend_free_trampoline(fcc->function_handler); diff --git a/ext/standard/tests/bug75220.phpt b/ext/standard/tests/bug75220.phpt new file mode 100644 index 0000000000..f5820a12dd --- /dev/null +++ b/ext/standard/tests/bug75220.phpt @@ -0,0 +1,28 @@ +--TEST-- +Bug #75220 (is_callable crash for 'parent') +--FILE-- +bar('foo'); + +class B {}; +class A extends B +{ + function bar($func) + { + var_dump('foo'); + var_dump(is_callable('parent::foo')); + var_dump(is_callable(array('parent', 'foo'))); + } + + function __call($func, $args) + { + } +}; + +?> +--EXPECT-- +string(3) "foo" +bool(false) +bool(false) \ No newline at end of file -- 2.49.0