php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-04-14 11:32:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-7.3'

Browse Source
This commit is contained in:
Nikita Popov
2018-09-19 09:40:12 +02:00
parent 6f1a04120b 040ca85eac
commit 10a1cfd17e
2 changed files with 22 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
Zend/tests/bug76901.phpt Normal file
View File

@@ -0,0 +1,18 @@
--TEST--
Bug #76901: method_exists on SPL iterator passthrough method corrupts memory
--FILE--
<?php
$it = new ArrayIterator([1, 2, 3]);
$it = new IteratorIterator($it);
foreach ($it as $v) {
if (method_exists($it, 'offsetGet')) {
var_dump($it->offsetGet(0));
}
}
?>
--EXPECT--
int(1)
int(1)
int(1)

11
Zend/zend_builtin_functions.c
View File

@@ -1343,13 +1343,10 @@ ZEND_FUNCTION(method_exists)
if (zend_hash_exists(&ce->function_table, lcname)) {
zend_string_release_ex(lcname, 0);
RETURN_TRUE;
} else {
zend_function *func = NULL;
if (Z_TYPE_P(klass) == IS_OBJECT
&& Z_OBJ_HT_P(klass)->get_method != NULL
&& (func = Z_OBJ_HT_P(klass)->get_method(&Z_OBJ_P(klass), method_name, NULL)) != NULL
) {
} else if (Z_TYPE_P(klass) == IS_OBJECT && Z_OBJ_HT_P(klass)->get_method != NULL) {
zend_object *obj = Z_OBJ_P(klass);
zend_function *func = Z_OBJ_HT_P(klass)->get_method(&obj, method_name, NULL);
if (func != NULL) {
if (func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
/* Returns true to the fake Closure's __invoke */
RETVAL_BOOL(func->common.scope == zend_ce_closure