Fixed bug #78658

nikic · nikic · commit 6fd6ad8f53f6 · 2019-10-09T17:00:27.000+02:00
diff --git a/NEWS b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.12
 
+- Core:
+  . Fixed bug #78658 (Memory corruption using Closure::bindTo). (Nikita)
+
 - Iconv:
   . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
     cmb).
diff --git a/Zend/tests/bug78658.phpt b/Zend/tests/bug78658.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #78658: Memory corruption using Closure::bindTo()
+--FILE--
+<?php
+
+$c = function(){};
+
+$scope = "AAAA";
+$scope = "{$scope}BBBB";
+$c->bindTo(new stdClass, $scope);
+
+?>
+--EXPECTF--
+Warning: Class 'AAAABBBB' not found in %s on line %d
diff --git a/Zend/zend_closures.c b/Zend/zend_closures.c
@@ -200,7 +200,7 @@ ZEND_METHOD(Closure, bind)
 				ce = closure->func.common.scope;
 			} else if ((ce = zend_lookup_class_ex(class_name, NULL, 1)) == NULL) {
 				zend_error(E_WARNING, "Class '%s' not found", ZSTR_VAL(class_name));
-				zend_string_release_ex(class_name, 0);
+				zend_tmp_string_release(tmp_class_name);
 				RETURN_NULL();
 			}
 			zend_tmp_string_release(tmp_class_name);

Original file line number	Diff line number	Diff line change
`@@ -200,7 +200,7 @@ ZEND_METHOD(Closure, bind)`
`200`	`200`	`ce = closure->func.common.scope;`
`201`	`201`	`} else if ((ce = zend_lookup_class_ex(class_name, NULL, 1)) == NULL) {`
`202`	`202`	`zend_error(E_WARNING, "Class '%s' not found", ZSTR_VAL(class_name));`
`203`		`- zend_string_release_ex(class_name, 0);`
	`203`	`+ zend_tmp_string_release(tmp_class_name);`
`204`	`204`	`RETURN_NULL();`
`205`	`205`	`}`
`206`	`206`	`zend_tmp_string_release(tmp_class_name);`