- Bugfix #32290

2 files changed, 43 insertions, 0 deletions

diff --git a/Zend/tests/bug32290.phpt b/Zend/tests/bug32290.phpt
new file mode 100755
index 0000000000..f754275ccf
--- /dev/null
+++ b/Zend/tests/bug32290.phpt
@@ -0,0 +1,35 @@
+--TEST--
+Bug #32290 (calling call_user_func_array() ends in infinite loop within child class)
+--FILE--
+<?php
+
+class TestA
+{
+	public function doSomething($i)
+	{
+		echo __METHOD__ . "($this)\n";
+		return --$i;
+	}
+}
+
+class TestB extends TestA
+{
+	public function doSomething($i)
+	{
+		echo __METHOD__ . "($this)\n";
+		$i++;
+		if ($i >= 5) return 5;
+		return call_user_func_array(array("TestA","doSomething"), array($i));
+	}
+}
+
+$x = new TestB();
+var_dump($x->doSomething(1));
+
+?>
+===DONE===
+--EXPECTF--
+TestB::doSomething(Object id #%d)
+TestA::doSomething(Object id #%d)
+int(1)
+===DONE===
diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
index 305d20dc17..e9fd83b25b 100644
--- a/Zend/zend_execute_API.c
+++ b/Zend/zend_execute_API.c
@@ -693,6 +693,14 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 			}
 			EX(function_state).function = 
 			  Z_OBJ_HT_PP(fci->object_pp)->get_method(fci->object_pp, Z_STRVAL_P(fci->function_name), Z_STRLEN_P(fci->function_name) TSRMLS_CC);
+			if (EX(function_state).function && calling_scope != EX(function_state).function->common.scope) {
+				char *function_name_lc = zend_str_tolower_dup(Z_STRVAL_P(fci->function_name), Z_STRLEN_P(fci->function_name));
+				if (zend_hash_find(&calling_scope->function_table, function_name_lc, fci->function_name->value.str.len+1, (void **) &EX(function_state).function)==FAILURE) {
+					efree(function_name_lc);
+					zend_error(E_ERROR, "Object does not support parent class method calls");
+				}
+				efree(function_name_lc);
+			}
 		} else if (calling_scope) {
 			char *function_name_lc = zend_str_tolower_dup(Z_STRVAL_P(fci->function_name), Z_STRLEN_P(fci->function_name));