archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-16 05:58:45 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge branch 'PHP-7.1' into PHP-7.2

Browse source
This commit is contained in:
Nikita Popov 2018-09-19 09:38:17 +02:00
commit cc1fb02760
3 changed files with 24 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -5,6 +5,8 @@ PHP NEWS
- Core:
. Fixed bug #76800 (foreach inconsistent if array modified during loop).
(Dmitry)
. Fixed bug #76901 (method_exists on SPL iterator passthrough method corrupts
memory). (Nikita)
- CURL:
. Fixed bug #76480 (Use curl_multi_wait() so that timeouts are respected).

18
Zend/tests/bug76901.phpt Normal file
View file

@ -0,0 +1,18 @@
--TEST--
Bug #76901: method_exists on SPL iterator passthrough method corrupts memory
--FILE--
<?php
$it = new ArrayIterator([1, 2, 3]);
$it = new IteratorIterator($it);
foreach ($it as $v) {
if (method_exists($it, 'offsetGet')) {
var_dump($it->offsetGet(0));
}
}
?>
--EXPECT--
int(1)
int(1)
int(1)

11
Zend/zend_builtin_functions.c
View file

@ -1294,13 +1294,10 @@ ZEND_FUNCTION(method_exists)
if (zend_hash_exists(&ce->function_table, lcname)) {
zend_string_release(lcname);
RETURN_TRUE;
} else {
union _zend_function *func = NULL;
if (Z_TYPE_P(klass) == IS_OBJECT
&& Z_OBJ_HT_P(klass)->get_method != NULL
&& (func = Z_OBJ_HT_P(klass)->get_method(&Z_OBJ_P(klass), method_name, NULL)) != NULL
) {
} else if (Z_TYPE_P(klass) == IS_OBJECT && Z_OBJ_HT_P(klass)->get_method != NULL) {
zend_object *obj = Z_OBJ_P(klass);
zend_function *func = Z_OBJ_HT_P(klass)->get_method(&obj, method_name, NULL);
if (func != NULL) {
if (func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
/* Returns true to the fake Closure's __invoke */
RETVAL_BOOL(func->common.scope == zend_ce_closure