Crash when calling call_user_func with unknown function name

Bug #54910 Crash when calling call_user_func with unknown function name
Submitted: 2011-05-23 16:18 UTC Modified: 2011-05-31 11:21 UTC
From: aigors at inbox dot lv Assigned: dmitry (profile)
Status: Closed Package: Reproducible crash
PHP Version: 5.3.6 OS: Ubuntu 11.04
Private report: No CVE-ID: None

 [2011-05-23 16:18 UTC] aigors at inbox dot lv

Description:
------------
Firstly the function is_callable(array('B', 'noSuchMethod')) returns true even 
such static method does not exist. This could be caused by class A having magic 
method __call (which shouldn't accept static methods though).

Still because of this the code fails with segmentation fault.

Test script:
---------------
class A
{
    public function __call($method, $args)
    {
        if (stripos($method, 'get') === 0) {
            return $this->get();
        }
        
        throw new BadMethodCallException("No such method");
    }

    protected function get()
    {
        $class = get_class($this);
        $call = array($class, 'noSuchMethod');
        
        if (is_callable($call)) {
            call_user_func($call);
        }
    }

}

class B extends A {}

$input = new B();
echo $input->getEmail();


Expected result:
----------------
Script should end with no output.

Actual result:
--------------
Segmentation fault.

Patches

fix-crash-but-not-underlying-problem (last revision 2011-05-24 20:20 UTC by crrodriguez at opensuse dot org)

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports

 [2011-05-25 03:53 UTC] felipe@php.net

-Status: Open +Status: Assigned -Assigned To: +Assigned To: dmitry

 [2011-05-31 11:21 UTC] dmitry@php.net

-Status: Assigned +Status: Closed

 [2011-05-31 11:21 UTC] dmitry@php.net

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.