diff options
| author | Nikita Popov <nikic@php.net> | 2015-03-10 18:17:56 +0100 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2015-03-10 18:17:56 +0100 |
| commit | bc9f2fb8dfadc1dba4264695ded28f673c54dc75 (patch) | |
| tree | 9726c2b22f790f5872360ae679692acd773b3890 | |
| parent | c814b3294ad72baad8d9da52dbef81dcafded451 (diff) | |
| download | php-git-bc9f2fb8dfadc1dba4264695ded28f673c54dc75.tar.gz | |
Fixed bug #69212
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | Zend/tests/bug69212.phpt | 27 | ||||
| -rw-r--r-- | Zend/zend_vm_def.h | 4 | ||||
| -rw-r--r-- | Zend/zend_vm_execute.h | 4 |
4 files changed, 37 insertions, 0 deletions
@@ -8,6 +8,8 @@ PHP NEWS . Fixed bug #67626 (User exceptions not properly handled in streams). (Julian) . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai) + . Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in + __call/... arg passing). (Nikita) - Filter: . Fixed bug #69202: (FILTER_FLAG_STRIP_BACKTICK ignored unless other diff --git a/Zend/tests/bug69212.phpt b/Zend/tests/bug69212.phpt new file mode 100644 index 0000000000..801073e2ca --- /dev/null +++ b/Zend/tests/bug69212.phpt @@ -0,0 +1,27 @@ +--TEST-- +Bug #69212: Leaking VIA_HANDLER func when exception thrown in __call/... arg passing +--FILE-- +<?php + +class Test { + public static function __callStatic($method, $args) {} + public function __call($method, $args) {} +} + +function do_throw() { throw new Exception; } + +try { + Test::foo(do_throw()); +} catch (Exception $e) { + echo "Caught!\n"; +} +try { + (new Test)->bar(do_throw()); +} catch (Exception $e) { + echo "Caught!\n"; +} + +?> +--EXPECT-- +Caught! +Caught! diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h index 8954e69cc1..66758d47fa 100644 --- a/Zend/zend_vm_def.h +++ b/Zend/zend_vm_def.h @@ -5042,6 +5042,10 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY) } zval_ptr_dtor(&call->object); } + if (call->fbc->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) { + efree((char *) call->fbc->common.function_name); + efree(call->fbc); + } call--; } while (call >= EX(call_slots)); EX(call) = NULL; diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h index c0b64b61a3..58ca552b82 100644 --- a/Zend/zend_vm_execute.h +++ b/Zend/zend_vm_execute.h @@ -1022,6 +1022,10 @@ static int ZEND_FASTCALL ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER } zval_ptr_dtor(&call->object); } + if (call->fbc->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) { + efree((char *) call->fbc->common.function_name); + efree(call->fbc); + } call--; } while (call >= EX(call_slots)); EX(call) = NULL; |