php/archived-php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2026-03-24 00:02:20 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'PHP-8.4'

Browse Source 
* PHP-8.4:
  Fix propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline
This commit is contained in:
Ilija Tovilo
2024-10-22 14:49:33 +02:00
parent 7f6ad37e5d 9a093e753a
commit 9018d9aa37
3 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
Zend/tests/gh16515.phpt Normal file
View File

@@ -0,0 +1,16 @@
--TEST--
GH-16515: Incorrect propagation of ZEND_ACC_RETURN_REFERENCE for call trampoline
--FILE--
<?php
namespace Foo;
class Foo {
public function &__call($method, $args) {}
}
call_user_func((new Foo)->bar(...));
?>
--EXPECTF--
Notice: Only variable references should be returned by reference in %s on line %d

2
Zend/zend_closures.c
View File

@@ -871,7 +871,7 @@ void zend_closure_from_frame(zval *return_value, zend_execute_data *call) { /* {
memset(&trampoline, 0, sizeof(zend_internal_function));
trampoline.type = ZEND_INTERNAL_FUNCTION;
trampoline.fn_flags = mptr->common.fn_flags & (ZEND_ACC_STATIC | ZEND_ACC_VARIADIC);
trampoline.fn_flags = mptr->common.fn_flags & (ZEND_ACC_STATIC | ZEND_ACC_VARIADIC | ZEND_ACC_RETURN_REFERENCE);
trampoline.handler = zend_closure_call_magic;
trampoline.function_name = mptr->common.function_name;
trampoline.scope = mptr->common.scope;

5
Zend/zend_object_handlers.c
View File

@@ -1614,7 +1614,10 @@ ZEND_API zend_function *zend_get_call_trampoline_func(const zend_class_entry *ce
func->arg_flags[0] = 0;
func->arg_flags[1] = 0;
func->arg_flags[2] = 0;
func->fn_flags = ZEND_ACC_CALL_VIA_TRAMPOLINE | ZEND_ACC_PUBLIC | ZEND_ACC_VARIADIC;
func->fn_flags = ZEND_ACC_CALL_VIA_TRAMPOLINE
| ZEND_ACC_PUBLIC
| ZEND_ACC_VARIADIC
| (fbc->common.fn_flags & ZEND_ACC_RETURN_REFERENCE);
if (is_static) {
func->fn_flags |= ZEND_ACC_STATIC;
}