diff options
| author | Dmitry Stogov <dmitry@zend.com> | 2015-10-09 11:48:13 +0300 |
|---|---|---|
| committer | Dmitry Stogov <dmitry@zend.com> | 2015-10-09 11:48:13 +0300 |
| commit | 0847681b1ab40193815285a4e9736a058372bb8c (patch) | |
| tree | 03a4706da6207fa8f4e4e07f8e985b83ed3a691a | |
| parent | c6af0aa33f6dafe90f60b3d20231837f9e25dfb6 (diff) | |
| download | php-git-0847681b1ab40193815285a4e9736a058372bb8c.tar.gz | |
Fixed bug #70630 (Closure::call/bind() crash with ReflectionFunction->getClosure())
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | Zend/tests/bug70630.phpt | 10 | ||||
| -rw-r--r-- | Zend/zend_closures.c | 1 |
3 files changed, 13 insertions, 0 deletions
@@ -3,6 +3,8 @@ PHP NEWS 15 Oct 2015, PHP 7.0.0 RC 5 - Core: + . Fixed bug #70630 (Closure::call/bind() crash with ReflectionFunction-> + getClosure()). (Dmitry, Bob) . Fixed bug #70662 (Duplicate array key via undefined index error handler). (Nikita) diff --git a/Zend/tests/bug70630.phpt b/Zend/tests/bug70630.phpt new file mode 100644 index 0000000000..fc79949ce2 --- /dev/null +++ b/Zend/tests/bug70630.phpt @@ -0,0 +1,10 @@ +--TEST-- +Bug #70630 (Closure::call/bind() crash with ReflectionFunction->getClosure()) +--FILE-- +<?php +class a {} +$x = (new ReflectionFunction("substr"))->getClosure(); +$x->call(new a); +?> +--EXPECTF-- +Warning: a::substr() expects at least 2 parameters, 0 given in %s on line %d diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c index a394c91c60..4430e7b250 100644 --- a/Zend/zend_closures.c +++ b/Zend/zend_closures.c @@ -98,6 +98,7 @@ ZEND_METHOD(Closure, call) if (closure->func.type == ZEND_INTERNAL_FUNCTION) { /* verify that we aren't binding internal function to a wrong object */ if ((closure->func.common.fn_flags & ZEND_ACC_STATIC) == 0 && + closure->func.common.scope && !instanceof_function(Z_OBJCE_P(newthis), closure->func.common.scope)) { zend_error(E_WARNING, "Cannot bind function %s::%s to object of class %s", ZSTR_VAL(closure->func.common.scope->name), ZSTR_VAL(closure->func.common.function_name), ZSTR_VAL(Z_OBJCE_P(newthis)->name)); return; |