MFH: Fixed bug #54910 (Crash when calling call_user_func with unknown function name)

2 files changed, 33 insertions, 0 deletions

diff --git a/Zend/tests/bug54910.phpt b/Zend/tests/bug54910.phpt
new file mode 100644
index 0000000000..8808cd0609
--- /dev/null
+++ b/Zend/tests/bug54910.phpt
@@ -0,0 +1,28 @@
+--TEST--
+Bug #54910 (Crash when calling call_user_func with unknown function name)
+--FILE--
+<?php
+class A {
+    public function __call($method, $args) {
+        if (stripos($method, 'get') === 0) {
+            return $this->get();
+        } 
+        die("No such method - '$method'\n");
+    }
+
+    protected function get() {
+        $class = get_class($this);
+        $call = array($class, 'noSuchMethod');
+        
+        if (is_callable($call)) {
+            call_user_func($call);
+        }
+    }
+}
+
+class B extends A {}
+
+$input = new B();
+echo $input->getEmail();
+--EXPECT--
+No such method - 'noSuchMethod'
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 2b87648e30..d6933cf402 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -2773,6 +2773,11 @@ get_function_via_handler:
 			if (fcc->function_handler) {
 				retval = 1;
 				call_via_handler = (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) != 0;
+				if (call_via_handler && !fcc->object_ptr && EG(This) &&
+				    Z_OBJ_HT_P(EG(This))->get_class_entry &&
+				    instanceof_function(Z_OBJCE_P(EG(This)), fcc->calling_scope TSRMLS_CC)) {
+					fcc->object_ptr = EG(This);
+				}
 			}
 		}
 	}