Fixed bug #54910 (Crash when calling call_user_func with unknown function name)

Author: dstogov

NEWS

@@ -6,6 +6,8 @@ PHP                                                                        NEWS
 - Increased the backtrack limit from 100000 to 1000000 (Rasmus)
 
 - Zend Engine:
+  . Fixed bug #54910 (Crash when calling call_user_func with unknown function
+    name). (Dmitry)
   . Fixed bug #54804 (__halt_compiler and imported namespaces).
     (Pierrick, Felipe)
   . Fixed bug #54585 (track_errors causes segfault). (Dmitry)

Zend/tests/bug54910.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #54910 (Crash when calling call_user_func with unknown function name)
+--FILE--
+<?php
+class A {
+    public function __call($method, $args) {
+        if (stripos($method, 'get') === 0) {
+            return $this->get();
+        } 
+        die("No such method - '$method'\n");
+    }
+
+    protected function get() {
+        $class = get_class($this);
+        $call = array($class, 'noSuchMethod');
+        
+        if (is_callable($call)) {
+            call_user_func($call);
+        }
+    }
+}
+
+class B extends A {}
+
+$input = new B();
+echo $input->getEmail();
+--EXPECT--
+No such method - 'noSuchMethod'

Zend/zend_API.c

@@ -2590,6 +2590,11 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 			if (fcc->function_handler) {
 				retval = 1;
 				call_via_handler = (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) != 0;
+				if (call_via_handler && !fcc->object_ptr && EG(This) &&
+				    Z_OBJ_HT_P(EG(This))->get_class_entry &&
+				    instanceof_function(Z_OBJCE_P(EG(This)), fcc->calling_scope TSRMLS_CC)) {
+					fcc->object_ptr = EG(This);
+				}
 			}
 		}
 	}