diff options
| author | Nikita Popov <nikita.ppv@gmail.com> | 2019-10-09 16:59:38 +0200 |
|---|---|---|
| committer | Nikita Popov <nikita.ppv@gmail.com> | 2019-10-09 17:00:27 +0200 |
| commit | 6fd6ad8f53f68154fa23de25f400d89ae29d54d0 (patch) | |
| tree | 794003eb6a2a91a8b1b146cb5d4291ae22170022 | |
| parent | cbf589b17c45c5b225cbd190dbe09fa278a57e60 (diff) | |
| download | php-git-6fd6ad8f53f68154fa23de25f400d89ae29d54d0.tar.gz | |
Fixed bug #78658
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | Zend/tests/bug78658.phpt | 14 | ||||
| -rw-r--r-- | Zend/zend_closures.c | 2 |
3 files changed, 18 insertions, 1 deletions
@@ -2,6 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 7.3.12 +- Core: + . Fixed bug #78658 (Memory corruption using Closure::bindTo). (Nikita) + - Iconv: . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas, cmb). diff --git a/Zend/tests/bug78658.phpt b/Zend/tests/bug78658.phpt new file mode 100644 index 0000000000..3445b98b09 --- /dev/null +++ b/Zend/tests/bug78658.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #78658: Memory corruption using Closure::bindTo() +--FILE-- +<?php + +$c = function(){}; + +$scope = "AAAA"; +$scope = "{$scope}BBBB"; +$c->bindTo(new stdClass, $scope); + +?> +--EXPECTF-- +Warning: Class 'AAAABBBB' not found in %s on line %d diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c index ac63826262..fce69f12ff 100644 --- a/Zend/zend_closures.c +++ b/Zend/zend_closures.c @@ -200,7 +200,7 @@ ZEND_METHOD(Closure, bind) ce = closure->func.common.scope; } else if ((ce = zend_lookup_class_ex(class_name, NULL, 1)) == NULL) { zend_error(E_WARNING, "Class '%s' not found", ZSTR_VAL(class_name)); - zend_string_release_ex(class_name, 0); + zend_tmp_string_release(tmp_class_name); RETURN_NULL(); } zend_tmp_string_release(tmp_class_name); |