php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #54910 Crash when calling call_user_func with unknown function name
Submitted: 2011-05-23 16:18 UTC Modified: 2011-05-31 11:21 UTC
From: aigors at inbox dot lv Assigned: dmitry
Status: Closed Package: Reproducible crash
PHP Version: 5.3.6 OS: Ubuntu 11.04
Private report: No CVE-ID:
 [2011-05-23 16:18 UTC] aigors at inbox dot lv
Description:
------------
Firstly the function is_callable(array('B', 'noSuchMethod')) returns true even 
such static method does not exist. This could be caused by class A having magic 
method __call (which shouldn't accept static methods though).

Still because of this the code fails with segmentation fault.

Test script:
---------------
class A
{
    public function __call($method, $args)
    {
        if (stripos($method, 'get') === 0) {
            return $this->get();
        }
        
        throw new BadMethodCallException("No such method");
    }

    protected function get()
    {
        $class = get_class($this);
        $call = array($class, 'noSuchMethod');
        
        if (is_callable($call)) {
            call_user_func($call);
        }
    }

}

class B extends A {}

$input = new B();
echo $input->getEmail();


Expected result:
----------------
Script should end with no output.

Actual result:
--------------
Segmentation fault.

Patches

fix-crash-but-not-underlying-problem (last revision 2011-05-24 20:20 UTC) by crrodriguez at opensuse dot org)

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-05-25 03:53 UTC] felipe@php.net
-Status: Open +Status: Assigned -Assigned To: +Assigned To: dmitry
 [2011-05-31 11:20 UTC] dmitry@php.net
Automatic comment from SVN on behalf of dmitry
Revision: http://svn.php.net/viewvc/?view=revision&revision=311635
Log: Fixed bug #54910 (Crash when calling call_user_func with unknown function name)
 [2011-05-31 11:21 UTC] dmitry@php.net
-Status: Assigned +Status: Closed
 [2011-05-31 11:21 UTC] dmitry@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.


 [2011-05-31 13:37 UTC] dmitry@php.net
Automatic comment from SVN on behalf of dmitry
Revision: http://svn.php.net/viewvc/?view=revision&revision=311653
Log: MFH: Fixed bug #54910 (Crash when calling call_user_func with unknown function name)
 [2012-04-18 09:50 UTC] laruence@php.net
Automatic comment on behalf of dmitry
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d9ba7820d47e224dc516803363542dd32d81a47e
Log: Fixed bug #54910 (Crash when calling call_user_func with unknown function name)
 [2012-07-24 23:41 UTC] rasmus@php.net
Automatic comment on behalf of dmitry
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d9ba7820d47e224dc516803363542dd32d81a47e
Log: Fixed bug #54910 (Crash when calling call_user_func with unknown function name)
 [2013-11-17 09:38 UTC] laruence@php.net
Automatic comment on behalf of dmitry
Revision: http://git.php.net/?p=php-src.git;a=commit;h=d9ba7820d47e224dc516803363542dd32d81a47e
Log: Fixed bug #54910 (Crash when calling call_user_func with unknown function name)
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Mon Apr 21 04:01:57 2014 UTC