diff options
| -rw-r--r-- | NEWS | 1 | ||||
| -rw-r--r-- | Zend/tests/bug78658.phpt | 14 | ||||
| -rw-r--r-- | Zend/zend_closures.c | 2 |
3 files changed, 16 insertions, 1 deletions
@@ -10,6 +10,7 @@ PHP NEWS checking priv. methods). (Nikita) . Fixed bug #78644 (SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER). (Nikita) + . Fixed bug #78658 (Memory corruption using Closure::bindTo). (Nikita) - COM: . Fixed bug #78650 (new COM Crash). (cmb) diff --git a/Zend/tests/bug78658.phpt b/Zend/tests/bug78658.phpt new file mode 100644 index 0000000000..3445b98b09 --- /dev/null +++ b/Zend/tests/bug78658.phpt @@ -0,0 +1,14 @@ +--TEST-- +Bug #78658: Memory corruption using Closure::bindTo() +--FILE-- +<?php + +$c = function(){}; + +$scope = "AAAA"; +$scope = "{$scope}BBBB"; +$c->bindTo(new stdClass, $scope); + +?> +--EXPECTF-- +Warning: Class 'AAAABBBB' not found in %s on line %d diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c index ae22ea3ecd..de80902852 100644 --- a/Zend/zend_closures.c +++ b/Zend/zend_closures.c @@ -216,7 +216,7 @@ ZEND_METHOD(Closure, bind) ce = closure->func.common.scope; } else if ((ce = zend_lookup_class(class_name)) == NULL) { zend_error(E_WARNING, "Class '%s' not found", ZSTR_VAL(class_name)); - zend_string_release_ex(class_name, 0); + zend_tmp_string_release(tmp_class_name); RETURN_NULL(); } zend_tmp_string_release(tmp_class_name); |