Crash when calling call_user_func with unknown function name
| Bug #54910 | Crash when calling call_user_func with unknown function name | ||||
|---|---|---|---|---|---|
| Submitted: | 2011-05-23 16:18 UTC | Modified: | 2011-05-31 11:21 UTC | ||
| From: | aigors at inbox dot lv | Assigned: | dmitry (profile) | ||
| Status: | Closed | Package: | Reproducible crash | ||
| PHP Version: | 5.3.6 | OS: | Ubuntu 11.04 | ||
| Private report: | No | CVE-ID: | None | ||
[2011-05-23 16:18 UTC] aigors at inbox dot lv
Description:
------------
Firstly the function is_callable(array('B', 'noSuchMethod')) returns true even
such static method does not exist. This could be caused by class A having magic
method __call (which shouldn't accept static methods though).
Still because of this the code fails with segmentation fault.
Test script:
---------------
class A
{
public function __call($method, $args)
{
if (stripos($method, 'get') === 0) {
return $this->get();
}
throw new BadMethodCallException("No such method");
}
protected function get()
{
$class = get_class($this);
$call = array($class, 'noSuchMethod');
if (is_callable($call)) {
call_user_func($call);
}
}
}
class B extends A {}
$input = new B();
echo $input->getEmail();
Expected result:
----------------
Script should end with no output.
Actual result:
--------------
Segmentation fault.
Patches
fix-crash-but-not-underlying-problem (last revision 2011-05-24 20:20 UTC by crrodriguez at opensuse dot org)Pull Requests
History
AllCommentsChangesGit/SVN commits
[2011-05-25 03:53 UTC] felipe@php.net
-Status: Open +Status: Assigned -Assigned To: +Assigned To: dmitry
[2011-05-31 11:21 UTC] dmitry@php.net
-Status: Assigned +Status: Closed
[2011-05-31 11:21 UTC] dmitry@php.net