php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #61766 call_user_func sends scrambled class name to autoload
Submitted: 2012-04-18 15:19 UTC Modified: 2012-04-20 01:54 UTC
From: admin dot windows at gmail dot com Assigned:
Status: Not a bug Package: *General Issues
PHP Version: 5.3.10 OS: ALL
Private report: No CVE-ID: None
 [2012-04-18 15:19 UTC] admin dot windows at gmail dot com
Description:
------------
I have discovered weird behaviour of call_user_func that breaks class autoloader by providing scrambled class name for example instead of "myObject" it provides "zw87zl18".
This event only occurs if you are using custom class autoloader and requesting static method that is not declared as static.

Test script:
---------------
//FILE: myObject.php
class myObject {
    public static function method1(){var_dump(__METHOD__);}
    public function method2(){var_dump(__METHOD__);}
}

//FILE: index.php
ini_set('display_errors', TRUE);

function __autoload($className) {
   include sprintf('%s/%s.php', getcwd(), $className);
}

call_user_func(array('myObject', 'method1'));//works fine

call_user_func(array('myObject', 'method2'));//produce an error

Expected result:
----------------
string(17) "myObject::method1"
string(17) "myObject::method2"

Actual result:
--------------
string(17) "myObject::method1"
Warning: include(/www/zw87zl18.php) [function.include]: failed to open stream: No such file or directory in /www/index.php on line 9

Warning: include() [function.include]: Failed opening '/www/zw87zl18.php' for inclusion (include_path='.:/usr/share/pear:/usr/share/php') in /www/index.php on line 9

Warning: include(/www/zw87zl18.php) [function.include]: failed to open stream: No such file or directory in /www/index.php on line 9

Warning: include() [function.include]: Failed opening '/www/zw87zl18.php' for inclusion (include_path='.:/usr/share/pear:/usr/share/php') in /www/index.php on line 9
string(17) "myObject::method2" 

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2012-04-19 07:07 UTC] aharvey@php.net
-Status: Open +Status: Feedback
 [2012-04-19 07:07 UTC] aharvey@php.net
I can't reproduce this.

What extensions do you have enabled?
 [2012-04-19 09:06 UTC] admin dot windows at gmail dot com
-Status: Feedback +Status: Open
 [2012-04-19 09:06 UTC] admin dot windows at gmail dot com
Hi,
I have following extensions enabled on my hosting (Rackspace):

Core, date, ereg, libxml, openssl, pcre, sqlite3, zlib, bz2, calendar, ctype, 
hash, filter, ftp, gettext, gmp, SPL, iconv, Reflection, session, standard, 
shmop, SimpleXML, sockets, exif, tokenizer, xml, apache2handler, bcmath, curl, 
dba, dom, fileinfo, gd, imagick, imap, intl, json, ldap, pdf, mbstring, mcrypt, 
memcache, mongo, mssql, mysql, mysqli, odbc, PDO, pdo_dblib, pdo_mysql, 
PDO_ODBC, pdo_pgsql, pdo_sqlite, pgsql, Phar, posix, pspell, recode, redis, 
snmp, soap, sysvmsg, sysvsem, sysvshm, tidy, uploadprogress, wddx, xmlreader, 
xmlrpc, xmlwriter, xsl, yaz, zip, ionCube Loader, Zend Guard Loader, XCache
 [2012-04-19 09:21 UTC] johannes@php.net
Please disable ionCube Loader, Zend Guard Loader and XCache as all of these 3rd party modules change the engine's behaviour.
 [2012-04-19 09:21 UTC] johannes@php.net
-Status: Open +Status: Feedback
 [2012-04-19 10:37 UTC] admin dot windows at gmail dot com
Unfortunately I don't have rights to enable or disable modules on my cloud, I 
would pass this issue to my hosting support.
Also I noticed that server is protected with the Suhosin Patch 0.9.10 can it cause 
this behavior?
 [2012-04-19 10:37 UTC] admin dot windows at gmail dot com
-Status: Feedback +Status: Open
 [2012-04-20 01:54 UTC] aharvey@php.net
-Status: Open +Status: Not a bug
 [2012-04-20 01:54 UTC] aharvey@php.net
We really can't support any third party extensions. It could be any or none of 
them.

Since you're unable to disable those extensions, I'm going to close this bug for 
now. If you are able to get your host to disable all third party extensions, 
including the Suhosin patch, and the behaviour recurs, please reopen the bug.
 [2012-05-25 09:35 UTC] hefi at lajt dot hu
I met the same problem. I found that if I commented out ZendGuardLoader.so then it would worked fine!
 [2012-09-18 23:29 UTC] php at guyjohnson dot org
I am encountering a very similar problem. I use call_user_func_array to execute 
a static class method and I get a corrupted call. Unlike the original report, 
it's not the class name that's corrupted, but rather the method name in my case. 
Here's the code:

return array_keys(call_user_func_array(array(get_called_class(), 'fielddefs'), 
func_get_args()));

By the time the method is called, the method name is completely corrupted to 
become this method name: &j-2!?{7k

Here's a string-ified backtrace: 
exception 'ErrorException' with message 'WARNING: Attempt to call e_member->&j-
2!?{7k failed because "" is not callable (iaw:element:member.&j-2!?{7k).' in 
/home7/inneract/sites/iawtest/lib/capcelinstance.php:650
Stack trace:
#0 [internal function]: CapcelInstance->__call('&j-2!?{7k', Array)
#1 [internal function]: e_member->&j-2!?{7k(Object(CapcelPortal), 10, NULL, 
Array)
#2 /home7/inneract/sites/iawtest/lib/capcelinstance.php(282): 
call_user_func_array(Array, Array)
#3 [internal function]: CapcelInstance->field_list(Object(CapcelPortal), 10, 
NULL, Array)
#4 /home7/inneract/sites/iawtest/lib/capcelinstance.php(324): 
call_user_func_array(Array, Array)
#5 /home7/inneract/sites/iawtest/app/iaw/a_establishmember.php(115): 
CapcelInstance->render_fields(Object(CapcelPortal), 10, NULL, Array)
#6 /home7/inneract/sites/iawtest/app/web/scheduler.php(31): a_EstablishMember-
>render(Object(CapcelPortal), Array)
#7 {main}

Frame 0 and the exception itself are only symptoms. The problem is first visible 
in frame 1 and there is no trace of a problem when call_user_func_array() is 
called in line 282 of the code as shown in frame 2.

I have examined a full backtrace in detail and confirmed that there is no 
corruption of any kind visible going into the call to call_user_func_array(). 
The method "fielddefs" does exist in the class CapcelInstance, of which e_member 
is a subclass.

I strongly believe there's a real bug in call_user_func_array... some kind of 
data corruption occurs as it executes and before it calls the target callable.
 [2012-09-18 23:48 UTC] php at guyjohnson dot org
Dropping the zend guard loader did the trick! Sorry I didn't read the whole thread 
before posting... first time here. Thanks!
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Tue Mar 25 19:01:29 2025 UTC