diff --git a/NEWS b/NEWS index b7d193ab581..e96d88f4c1c 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,9 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 7.3.12 +- Core: + . Fixed bug #78658 (Memory corruption using Closure::bindTo). (Nikita) + - Iconv: . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas, cmb). diff --git a/Zend/tests/bug78658.phpt b/Zend/tests/bug78658.phpt new file mode 100644 index 00000000000..3445b98b097 --- /dev/null +++ b/Zend/tests/bug78658.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #78658: Memory corruption using Closure::bindTo() +--FILE-- +bindTo(new stdClass, $scope); + +?> +--EXPECTF-- +Warning: Class 'AAAABBBB' not found in %s on line %d diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c index ac638262624..fce69f12ff9 100644 --- a/Zend/zend_closures.c +++ b/Zend/zend_closures.c @@ -200,7 +200,7 @@ ZEND_METHOD(Closure, bind) ce = closure->func.common.scope; } else if ((ce = zend_lookup_class_ex(class_name, NULL, 1)) == NULL) { zend_error(E_WARNING, "Class '%s' not found", ZSTR_VAL(class_name)); - zend_string_release_ex(class_name, 0); + zend_tmp_string_release(tmp_class_name); RETURN_NULL(); } zend_tmp_string_release(tmp_class_name);