diff options
| -rw-r--r-- | NEWS | 3 | ||||
| -rw-r--r-- | Zend/zend_API.c | 9 | ||||
| -rw-r--r-- | ext/standard/tests/bug75220.phpt | 28 |
3 files changed, 37 insertions, 3 deletions
@@ -2,6 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 7.2.0RC4 +- Core + . Fixed bug #75220 (Segfault when calling is_callable on parent). + (andrewnester) 28 Sep 2017, PHP 7.2.0RC3 diff --git a/Zend/zend_API.c b/Zend/zend_API.c index 7c82d6ec25..6ec350ebf2 100644 --- a/Zend/zend_API.c +++ b/Zend/zend_API.c @@ -3129,7 +3129,8 @@ get_function_via_handler: (!fcc->function_handler->common.scope || !instanceof_function(ce_org, fcc->function_handler->common.scope))) { if (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) { - if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) { + if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && + fcc->function_handler->common.function_name) { zend_string_release(fcc->function_handler->common.function_name); } zend_free_trampoline(fcc->function_handler); @@ -3355,7 +3356,8 @@ again: ((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) || fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY || fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) { - if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) { + if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && + fcc->function_handler->common.function_name) { zend_string_release(fcc->function_handler->common.function_name); } zend_free_trampoline(fcc->function_handler); @@ -3413,7 +3415,8 @@ again: ((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) || fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY || fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) { - if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) { + if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && + fcc->function_handler->common.function_name) { zend_string_release(fcc->function_handler->common.function_name); } zend_free_trampoline(fcc->function_handler); diff --git a/ext/standard/tests/bug75220.phpt b/ext/standard/tests/bug75220.phpt new file mode 100644 index 0000000000..f5820a12dd --- /dev/null +++ b/ext/standard/tests/bug75220.phpt @@ -0,0 +1,28 @@ +--TEST-- +Bug #75220 (is_callable crash for 'parent') +--FILE-- +<?php + +$a = new A(); +$a->bar('foo'); + +class B {}; +class A extends B +{ + function bar($func) + { + var_dump('foo'); + var_dump(is_callable('parent::foo')); + var_dump(is_callable(array('parent', 'foo'))); + } + + function __call($func, $args) + { + } +}; + +?> +--EXPECT-- +string(3) "foo" +bool(false) +bool(false)
\ No newline at end of file |