From b06f8cb58bfb7310fff483cb739449e75cd90b79 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Wed, 9 Aug 2017 11:28:53 +0800
Subject: Fixed bug #75049 (spl_autoload_unregister can't handle
 spl_autoload_functions results)

---
 NEWS                        |  2 ++
 ext/spl/php_spl.c           | 20 ++++++++++++++++----
 ext/spl/tests/bug75049.phpt | 16 ++++++++++++++++
 3 files changed, 34 insertions(+), 4 deletions(-)
 create mode 100644 ext/spl/tests/bug75049.phpt

diff --git a/NEWS b/NEWS
index 7ff0849901..a1f33f209d 100644
--- a/NEWS
+++ b/NEWS
@@ -46,6 +46,8 @@ PHP                                                                        NEWS
     (Laruence)
 
 - SPL:
+  . Fixed bug #75049 (spl_autoload_unregister can't handle
+    spl_autoload_functions results). (Laruence)
   . Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester)
   . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien)
 
diff --git a/ext/spl/php_spl.c b/ext/spl/php_spl.c
index b8e10a563c..28a4fae00d 100644
--- a/ext/spl/php_spl.c
+++ b/ext/spl/php_spl.c
@@ -536,8 +536,14 @@ PHP_FUNCTION(spl_autoload_register)
 			ZSTR_VAL(lc_name)[ZSTR_LEN(lc_name)] = '\0';
 		} else {
 			ZVAL_UNDEF(&alfi.closure);
-			lc_name = zend_string_alloc(ZSTR_LEN(func_name), 0);
-			zend_str_tolower_copy(ZSTR_VAL(lc_name), ZSTR_VAL(func_name), ZSTR_LEN(func_name));
+			/* Skip leading \ */
+			if (ZSTR_VAL(func_name)[0] == '\\') {
+				lc_name = zend_string_alloc(ZSTR_LEN(func_name) - 1, 0);
+				zend_str_tolower_copy(ZSTR_VAL(lc_name), ZSTR_VAL(func_name) + 1, ZSTR_LEN(func_name) - 1);
+			} else {
+				lc_name = zend_string_alloc(ZSTR_LEN(func_name), 0);
+				zend_str_tolower_copy(ZSTR_VAL(lc_name), ZSTR_VAL(func_name), ZSTR_LEN(func_name));
+			}
 		}
 		zend_string_release(func_name);
 
@@ -655,8 +661,14 @@ PHP_FUNCTION(spl_autoload_unregister)
 		memcpy(ZSTR_VAL(lc_name) + ZSTR_LEN(func_name), &Z_OBJ_HANDLE_P(zcallable), sizeof(uint32_t));
 		ZSTR_VAL(lc_name)[ZSTR_LEN(lc_name)] = '\0';
 	} else {
-		lc_name = zend_string_alloc(ZSTR_LEN(func_name), 0);
-		zend_str_tolower_copy(ZSTR_VAL(lc_name), ZSTR_VAL(func_name), ZSTR_LEN(func_name));
+		/* Skip leading \ */
+		if (ZSTR_VAL(func_name)[0] == '\\') {
+			lc_name = zend_string_alloc(ZSTR_LEN(func_name) - 1, 0);
+			zend_str_tolower_copy(ZSTR_VAL(lc_name), ZSTR_VAL(func_name) + 1, ZSTR_LEN(func_name) - 1);
+		} else {
+			lc_name = zend_string_alloc(ZSTR_LEN(func_name), 0);
+			zend_str_tolower_copy(ZSTR_VAL(lc_name), ZSTR_VAL(func_name), ZSTR_LEN(func_name));
+		}
 	}
 	zend_string_release(func_name);
 
diff --git a/ext/spl/tests/bug75049.phpt b/ext/spl/tests/bug75049.phpt
new file mode 100644
index 0000000000..2f03a3b031
--- /dev/null
+++ b/ext/spl/tests/bug75049.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #75049 (spl_autoload_unregister can't handle spl_autoload_functions results)
+--FILE--
+<?php
+class Auto { public static function loader() {}}
+$autoloader = '\Auto::loader';
+
+echo (int)spl_autoload_register($autoloader);
+echo (int)spl_autoload_unregister($autoloader);
+echo (int)spl_autoload_register($autoloader);
+foreach (spl_autoload_functions() as $loader) {
+	echo (int)spl_autoload_unregister($loader);
+}
+echo (int)count(spl_autoload_functions());
+--EXPECTF--
+11110
-- 
cgit v1.2.1