- Fixed invalid free in call_user_method() function

php · Nov 22, 2011 · 3759497 · 3759497
1 parent cc8c3a2
commit 3759497
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 1 deletion.
diff --git a/NEWS b/NEWS
@@ -12,6 +12,7 @@ PHP                                                                        NEWS
     directory). (Felipe)
   . Fixed bug #55748 (multiple NULL Pointer Dereference with zend_strndup()) 
     (CVE-2011-4153). (Stas)
+  . Fixed invalid free in call_user_method() function. (Felipe)
 
 - Zend Engine:
   . Fixed bug #43200 (Interface implementation / inheritence not possible in

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
@@ -4762,7 +4762,9 @@ PHP_FUNCTION(call_user_method)
 		Z_TYPE_P(object) != IS_STRING
 	) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Second argument is not an object or class name");
-		efree(params);
+		if (params) {
+			efree(params);
+		}
 		RETURN_FALSE;
 	}
 

diff --git a/ext/standard/tests/general_functions/call_user_method_002.phpt b/ext/standard/tests/general_functions/call_user_method_002.phpt
@@ -0,0 +1,12 @@
+--TEST--
+call_user_method() Invalid free
+--FILE--
+<?php
+
+call_user_method("1", $arr1);
+
+?>
+--EXPECTF--
+Deprecated: Function call_user_method() is deprecated in %s on line %d
+
+Warning: call_user_method(): Second argument is not an object or class name in %s on line %d